diff options
| author | Scott Mansell <phiren@gmail.com> | 2026-07-26 18:15:07 +1200 |
|---|---|---|
| committer | Scott Mansell <phiren@gmail.com> | 2026-07-28 19:44:49 +1200 |
| commit | ffb0e2c59406c485a983098ad5bd85f8b3ae376e (patch) | |
| tree | 7445a094f3d1f98ee7c7e1f6a9bcccd87f59e25d | |
| parent | a3740b5f713eb6a93981690fd52789a02ab8127d (diff) | |
GCZ: Don't trust block_num either
SectorReader::ReadChunk does do some validation on it, but it only
checks against the original disc size (reported by the GCZ file).
It has no idea how many blocks the header claimed the disc had.
A maliciously crafted GCZ file could trigger read overflows off the end
of the m_block_pointers/m_hashes arrays.
| -rw-r--r-- | Source/Core/DiscIO/CompressedBlob.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/Source/Core/DiscIO/CompressedBlob.cpp b/Source/Core/DiscIO/CompressedBlob.cpp index eae4d4ccaf..036e139d0b 100644 --- a/Source/Core/DiscIO/CompressedBlob.cpp +++ b/Source/Core/DiscIO/CompressedBlob.cpp @@ -94,6 +94,9 @@ u64 CompressedBlobReader::GetBlockCompressedSize(u64 block_num) const bool CompressedBlobReader::GetBlock(u64 block_num, u8* out_ptr) { + if (block_num >= m_header.num_blocks) + return false; + bool uncompressed = false; u64 read_size = GetBlockCompressedSize(block_num); u64 offset = m_block_pointers[block_num] + m_data_offset; |