NetPlay: Fix chunked data buffer overflow

Reported by MrSynAckster.

1 files changed, 12 insertions, 0 deletions

diff --git a/Source/Core/Core/NetPlayCommon.cpp b/Source/Core/Core/NetPlayCommon.cpp
index f1a580cf09..89ec2864a1 100644
--- a/Source/Core/Core/NetPlayCommon.cpp
+++ b/Source/Core/Core/NetPlayCommon.cpp
@@ -197,6 +197,12 @@ bool DecompressPacketIntoFile(sf::Packet& packet, const std::string& file_path)
     if (!cur_len)
       break;  // We reached the end of the data stream
 
+    if (cur_len > in_buffer.size())
+    {
+      PanicAlertFmt("LZO error - input is too large");
+      return false;
+    }
+
     for (size_t j = 0; j < cur_len; j++)
     {
       packet >> in_buffer[j];
@@ -281,6 +287,12 @@ std::optional<std::vector<u8>> DecompressPacketIntoBuffer(sf::Packet& packet)
     if (!cur_len)
       break;  // We reached the end of the data stream
 
+    if (cur_len > in_buffer.size())
+    {
+      PanicAlertFmt("LZO error - input is too large");
+      return {};
+    }
+
     for (size_t j = 0; j < cur_len; j++)
     {
       packet >> in_buffer[j];