From 747e1e0d92acedf0c0d49e4d6c7b2bcec4d9f301 Mon Sep 17 00:00:00 2001 From: JosJuice Date: Sat, 30 May 2026 16:35:16 +0200 Subject: NetPlay: Fix Wii save banner buffer overflow Reported by MrSynAckster. --- Source/Core/Core/NetPlayClient.cpp | 2 +- Source/Core/Core/NetPlayServer.cpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Source/Core/Core/NetPlayClient.cpp b/Source/Core/Core/NetPlayClient.cpp index 8c38fc0b53..20edd35c0e 100644 --- a/Source/Core/Core/NetPlayClient.cpp +++ b/Source/Core/Core/NetPlayClient.cpp @@ -1211,7 +1211,7 @@ void NetPlayClient::OnSyncSaveDataWii(sf::Packet& packet) for (u8& byte : header.md5) packet >> byte; packet >> header.unk2; - for (size_t i = 0; i < header.banner_size; i++) + for (size_t i = 0; i < std::min(header.banner_size, sizeof(header.banner)); i++) packet >> header.banner[i]; // BkHeader diff --git a/Source/Core/Core/NetPlayServer.cpp b/Source/Core/Core/NetPlayServer.cpp index 57cd691060..8f6ba17368 100644 --- a/Source/Core/Core/NetPlayServer.cpp +++ b/Source/Core/Core/NetPlayServer.cpp @@ -1976,7 +1976,7 @@ bool NetPlayServer::SyncSaveData(const SaveSyncInfo& sync_info) for (u8 byte : header->md5) pac << byte; pac << header->unk2; - for (size_t i = 0; i < header->banner_size; i++) + for (size_t i = 0; i < std::min(header->banner_size, sizeof(header->banner)); i++) pac << header->banner[i]; // BkHeader -- cgit v1.2.3 From 5aed26fb11fae0f58af6dce6c196f31f20598b3a Mon Sep 17 00:00:00 2001 From: JosJuice Date: Sat, 30 May 2026 17:00:36 +0200 Subject: NetPlay: Fix chunked data buffer overflow Reported by MrSynAckster. --- Source/Core/Core/NetPlayCommon.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/Source/Core/Core/NetPlayCommon.cpp b/Source/Core/Core/NetPlayCommon.cpp index f1a580cf09..89ec2864a1 100644 --- a/Source/Core/Core/NetPlayCommon.cpp +++ b/Source/Core/Core/NetPlayCommon.cpp @@ -197,6 +197,12 @@ bool DecompressPacketIntoFile(sf::Packet& packet, const std::string& file_path) if (!cur_len) break; // We reached the end of the data stream + if (cur_len > in_buffer.size()) + { + PanicAlertFmt("LZO error - input is too large"); + return false; + } + for (size_t j = 0; j < cur_len; j++) { packet >> in_buffer[j]; @@ -281,6 +287,12 @@ std::optional> DecompressPacketIntoBuffer(sf::Packet& packet) if (!cur_len) break; // We reached the end of the data stream + if (cur_len > in_buffer.size()) + { + PanicAlertFmt("LZO error - input is too large"); + return {}; + } + for (size_t j = 0; j < cur_len; j++) { packet >> in_buffer[j]; -- cgit v1.2.3