diff options
| author | Nicola Vella <nicola.vella@hotmail.com> | 2023-10-06 19:30:03 +0200 |
|---|---|---|
| committer | Nicola Vella <nicola.vella@hotmail.com> | 2023-10-06 19:30:03 +0200 |
| commit | 31dfb53152bc22f2ad1aab4fdd13c01b67444d2d (patch) | |
| tree | 25668fb6914f7305fc38f05966e2608c7b65644d /Source/Core | |
| parent | 1c433d5f3f0c1da6fd95504e4d6f9cef4fa2e118 (diff) | |
Fix heap buffer overflow in GCMemcardRaw
Diffstat (limited to 'Source/Core')
| -rw-r--r-- | Source/Core/Core/HW/GCMemcard/GCMemcardRaw.cpp | 6 | ||||
| -rw-r--r-- | Source/Core/Core/HW/GCMemcard/GCMemcardRaw.h | 2 |
2 files changed, 4 insertions, 4 deletions
diff --git a/Source/Core/Core/HW/GCMemcard/GCMemcardRaw.cpp b/Source/Core/Core/HW/GCMemcard/GCMemcardRaw.cpp index a622b1145e..f5a3f6a8ba 100644 --- a/Source/Core/Core/HW/GCMemcard/GCMemcardRaw.cpp +++ b/Source/Core/Core/HW/GCMemcard/GCMemcardRaw.cpp @@ -169,7 +169,7 @@ void MemoryCard::MakeDirty() s32 MemoryCard::Read(u32 src_address, s32 length, u8* dest_address) { - if (!IsAddressInBounds(src_address)) + if (!IsAddressInBounds(src_address, length)) { PanicAlertFmtT("MemoryCard: Read called with invalid source address ({0:#x})", src_address); return -1; @@ -181,7 +181,7 @@ s32 MemoryCard::Read(u32 src_address, s32 length, u8* dest_address) s32 MemoryCard::Write(u32 dest_address, s32 length, const u8* src_address) { - if (!IsAddressInBounds(dest_address)) + if (!IsAddressInBounds(dest_address, length)) { PanicAlertFmtT("MemoryCard: Write called with invalid destination address ({0:#x})", dest_address); @@ -198,7 +198,7 @@ s32 MemoryCard::Write(u32 dest_address, s32 length, const u8* src_address) void MemoryCard::ClearBlock(u32 address) { - if (address & (Memcard::BLOCK_SIZE - 1) || !IsAddressInBounds(address)) + if (address & (Memcard::BLOCK_SIZE - 1) || !IsAddressInBounds(address, Memcard::BLOCK_SIZE)) { PanicAlertFmtT("MemoryCard: ClearBlock called on invalid address ({0:#x})", address); return; diff --git a/Source/Core/Core/HW/GCMemcard/GCMemcardRaw.h b/Source/Core/Core/HW/GCMemcard/GCMemcardRaw.h index c6c85313e8..067f795401 100644 --- a/Source/Core/Core/HW/GCMemcard/GCMemcardRaw.h +++ b/Source/Core/Core/HW/GCMemcard/GCMemcardRaw.h @@ -30,7 +30,7 @@ public: void DoState(PointerWrap& p) override; private: - bool IsAddressInBounds(u32 address) const { return address <= (m_memory_card_size - 1); } + bool IsAddressInBounds(u32 address, u32 length) const { return address + length <= (m_memory_card_size - 1); } std::string m_filename; std::unique_ptr<u8[]> m_memcard_data; |