EXI/BBA: Fix tx_fifo memory safety issues

Reported by MrSynAckster.

1 files changed, 6 insertions, 2 deletions

diff --git a/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp b/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp
index c49c6e32b9..631913f2d5 100644
--- a/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp
+++ b/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp
@@ -435,7 +435,11 @@ void CEXIETHERNET::DirectFIFOWrite(const u8* data, u32 size)
   // GMAC instead of finagling with packet descriptors and such
   u16* tx_fifo_count = (u16*)&mBbaMem[BBA_TXFIFOCNT];
 
-  memcpy(tx_fifo.get() + *tx_fifo_count, data, size);
+  if (*tx_fifo_count < BBA_TXFIFO_SIZE)
+  {
+    const u32 max_size = BBA_TXFIFO_SIZE - *tx_fifo_count;
+    memcpy(tx_fifo.get() + *tx_fifo_count, data, std::min(size, max_size));
+  }
 
   *tx_fifo_count += size;
   // TODO: not sure this mask is correct.
@@ -447,7 +451,7 @@ void CEXIETHERNET::DirectFIFOWrite(const u8* data, u32 size)
 void CEXIETHERNET::SendFromDirectFIFO()
 {
   const u8* frame = tx_fifo.get();
-  const u16 size = Common::BitCastPtr<u16>(&mBbaMem[BBA_TXFIFOCNT]);
+  const u16 size = std::min<u16>(BBA_TXFIFO_SIZE, Common::BitCastPtr<u16>(&mBbaMem[BBA_TXFIFOCNT]));
   if (m_network_interface->SendFrame(frame, size))
     m_system.GetPowerPC().GetDebugInterface().NetworkLogger()->LogBBA(frame, size);
 }