From 5aed26fb11fae0f58af6dce6c196f31f20598b3a Mon Sep 17 00:00:00 2001 From: JosJuice Date: Sat, 30 May 2026 17:00:36 +0200 Subject: NetPlay: Fix chunked data buffer overflow Reported by MrSynAckster. --- Source/Core/Core/NetPlayCommon.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/Source/Core/Core/NetPlayCommon.cpp b/Source/Core/Core/NetPlayCommon.cpp index f1a580cf09..89ec2864a1 100644 --- a/Source/Core/Core/NetPlayCommon.cpp +++ b/Source/Core/Core/NetPlayCommon.cpp @@ -197,6 +197,12 @@ bool DecompressPacketIntoFile(sf::Packet& packet, const std::string& file_path) if (!cur_len) break; // We reached the end of the data stream + if (cur_len > in_buffer.size()) + { + PanicAlertFmt("LZO error - input is too large"); + return false; + } + for (size_t j = 0; j < cur_len; j++) { packet >> in_buffer[j]; @@ -281,6 +287,12 @@ std::optional> DecompressPacketIntoBuffer(sf::Packet& packet) if (!cur_len) break; // We reached the end of the data stream + if (cur_len > in_buffer.size()) + { + PanicAlertFmt("LZO error - input is too large"); + return {}; + } + for (size_t j = 0; j < cur_len; j++) { packet >> in_buffer[j]; -- cgit v1.2.3