Merge pull request #14747 from AdmiralCurtiss/dsp-hle-oob

HW/DSPHLE/AXVoice: Check array bounds in ApplyUpdatesForMs()

1 files changed, 13 insertions, 8 deletions

diff --git a/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h b/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h
index 54531a85f6..636c22ce65 100644
--- a/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h
+++ b/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h
@@ -59,21 +59,26 @@ PBUpdateData LoadPBUpdates(Memory::MemoryManager& memory, const PB_TYPE& pb)
 // Apply updates to a PB.
 void ApplyUpdatesForMs(int curr_ms, PB_TYPE& pb, u16* num_updates, const PBUpdateData& updates)
 {
-  auto pb_mem = Common::BitCastToArray<u16>(pb);
-
   u32 start_idx = 0;
   for (int i = 0; i < curr_ms; ++i)
     start_idx += num_updates[i];
 
-  for (u32 i = start_idx; i < start_idx + num_updates[curr_ms]; ++i)
+  if (start_idx < updates.size())
   {
-    u16 update_off = updates[i].pb_offset;
-    u16 update_val = updates[i].new_value;
+    const u16 count = num_updates[curr_ms];
+    if (count <= updates.size() - start_idx)
+    {
+      const u32 end_idx = start_idx + count;
+      for (u32 i = start_idx; i < end_idx; ++i)
+      {
+        const u16 update_off = updates[i].pb_offset;
+        const u16 update_val = updates[i].new_value;
 
-    pb_mem[update_off] = update_val;
+        if (update_off < (sizeof(pb) / sizeof(u16)))
+          Common::BitCastPtr<u16>(&pb)[update_off] = update_val;
+      }
+    }
   }
-
-  pb = std::bit_cast<PB_TYPE>(pb_mem);
 }
 
 // Used to pass a large amount of buffers to the mixing function.