diff options
| author | JosJuice <josjuice@gmail.com> | 2026-06-21 21:44:22 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-06-21 21:44:22 +0200 |
| commit | 21f12fdc77cfbf472a3e4d57c8ed580be8000a53 (patch) | |
| tree | c023f1815f7880adb054569bba72acb63a4b2760 | |
| parent | 6bdf00ed217d618aa19ab1251da291e597c7cf36 (diff) | |
| parent | 5aed26fb11fae0f58af6dce6c196f31f20598b3a (diff) | |
Merge pull request #14692 from JosJuice/netplay-memory-safety
NetPlay: Fix memory safety issues
| -rw-r--r-- | Source/Core/Core/NetPlayClient.cpp | 2 | ||||
| -rw-r--r-- | Source/Core/Core/NetPlayCommon.cpp | 12 | ||||
| -rw-r--r-- | Source/Core/Core/NetPlayServer.cpp | 2 |
3 files changed, 14 insertions, 2 deletions
diff --git a/Source/Core/Core/NetPlayClient.cpp b/Source/Core/Core/NetPlayClient.cpp index 8c38fc0b53..20edd35c0e 100644 --- a/Source/Core/Core/NetPlayClient.cpp +++ b/Source/Core/Core/NetPlayClient.cpp @@ -1211,7 +1211,7 @@ void NetPlayClient::OnSyncSaveDataWii(sf::Packet& packet) for (u8& byte : header.md5) packet >> byte; packet >> header.unk2; - for (size_t i = 0; i < header.banner_size; i++) + for (size_t i = 0; i < std::min<size_t>(header.banner_size, sizeof(header.banner)); i++) packet >> header.banner[i]; // BkHeader diff --git a/Source/Core/Core/NetPlayCommon.cpp b/Source/Core/Core/NetPlayCommon.cpp index f1a580cf09..89ec2864a1 100644 --- a/Source/Core/Core/NetPlayCommon.cpp +++ b/Source/Core/Core/NetPlayCommon.cpp @@ -197,6 +197,12 @@ bool DecompressPacketIntoFile(sf::Packet& packet, const std::string& file_path) if (!cur_len) break; // We reached the end of the data stream + if (cur_len > in_buffer.size()) + { + PanicAlertFmt("LZO error - input is too large"); + return false; + } + for (size_t j = 0; j < cur_len; j++) { packet >> in_buffer[j]; @@ -281,6 +287,12 @@ std::optional<std::vector<u8>> DecompressPacketIntoBuffer(sf::Packet& packet) if (!cur_len) break; // We reached the end of the data stream + if (cur_len > in_buffer.size()) + { + PanicAlertFmt("LZO error - input is too large"); + return {}; + } + for (size_t j = 0; j < cur_len; j++) { packet >> in_buffer[j]; diff --git a/Source/Core/Core/NetPlayServer.cpp b/Source/Core/Core/NetPlayServer.cpp index 57cd691060..8f6ba17368 100644 --- a/Source/Core/Core/NetPlayServer.cpp +++ b/Source/Core/Core/NetPlayServer.cpp @@ -1976,7 +1976,7 @@ bool NetPlayServer::SyncSaveData(const SaveSyncInfo& sync_info) for (u8 byte : header->md5) pac << byte; pac << header->unk2; - for (size_t i = 0; i < header->banner_size; i++) + for (size_t i = 0; i < std::min<size_t>(header->banner_size, sizeof(header->banner)); i++) pac << header->banner[i]; // BkHeader |