From d5d2f7c8fb417632bea23f1d6122f49db9cee6e4 Mon Sep 17 00:00:00 2001 From: "Admiral H. Curtiss" Date: Wed, 22 Jul 2026 03:21:19 +0200 Subject: HW/DSPHLE/AXVoice: Check array bounds in ApplyUpdatesForMs() Fixes https://github.com/dolphin-emu/dolphin/security/advisories/GHSA-4q28-hhjv-hf3f --- Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h b/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h index 54531a85f6..1655e28074 100644 --- a/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h +++ b/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h @@ -65,12 +65,21 @@ void ApplyUpdatesForMs(int curr_ms, PB_TYPE& pb, u16* num_updates, const PBUpdat for (int i = 0; i < curr_ms; ++i) start_idx += num_updates[i]; - for (u32 i = start_idx; i < start_idx + num_updates[curr_ms]; ++i) + if (start_idx < updates.size()) { - u16 update_off = updates[i].pb_offset; - u16 update_val = updates[i].new_value; + const u16 count = num_updates[curr_ms]; + if (count <= updates.size() - start_idx) + { + const u32 end_idx = start_idx + count; + for (u32 i = start_idx; i < end_idx; ++i) + { + const u16 update_off = updates[i].pb_offset; + const u16 update_val = updates[i].new_value; - pb_mem[update_off] = update_val; + if (update_off < pb_mem.size()) + pb_mem[update_off] = update_val; + } + } } pb = std::bit_cast(pb_mem); -- cgit v1.2.3 From af38db4a238816dadb6a998f9d20808bab804159 Mon Sep 17 00:00:00 2001 From: "Admiral H. Curtiss" Date: Wed, 22 Jul 2026 12:18:43 +0200 Subject: HW/DSPHLE/AXVoice: Prefer BitCastPtr over BitCastToArray in ApplyUpdatesForMs() --- Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h b/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h index 1655e28074..636c22ce65 100644 --- a/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h +++ b/Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h @@ -59,8 +59,6 @@ PBUpdateData LoadPBUpdates(Memory::MemoryManager& memory, const PB_TYPE& pb) // Apply updates to a PB. void ApplyUpdatesForMs(int curr_ms, PB_TYPE& pb, u16* num_updates, const PBUpdateData& updates) { - auto pb_mem = Common::BitCastToArray(pb); - u32 start_idx = 0; for (int i = 0; i < curr_ms; ++i) start_idx += num_updates[i]; @@ -76,13 +74,11 @@ void ApplyUpdatesForMs(int curr_ms, PB_TYPE& pb, u16* num_updates, const PBUpdat const u16 update_off = updates[i].pb_offset; const u16 update_val = updates[i].new_value; - if (update_off < pb_mem.size()) - pb_mem[update_off] = update_val; + if (update_off < (sizeof(pb) / sizeof(u16))) + Common::BitCastPtr(&pb)[update_off] = update_val; } } } - - pb = std::bit_cast(pb_mem); } // Used to pass a large amount of buffers to the mixing function. -- cgit v1.2.3