mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-11-01 12:07:31 +01:00
Henrik RydgårdandClaude Opus 5.5
42f9af1744
A size that makes addr + size wrap around 32 bits had Split() build a slab that ends before it starts. Lookups then skipped it, and a later Merge() ran FillHeads() over it with a huge count, writing far outside heads_. Sizes come from games through HLE calls, and the large ones are recorded even without detailed mem info. Seen in a Play crash report, on the FlushMemInfo thread. FillHeads() also took the address one past the end of heads_ for a slab in the last slice, which Debug builds assert on. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>