From 900febec29bcfee8b7a1319ec74d9cb1bfb9d157 Mon Sep 17 00:00:00 2001 From: Khang Date: Wed, 15 Jul 2026 02:12:31 -0400 Subject: IOS/ES: Prevent reading TMDs that are too small --- Source/Core/Core/IOS/ES/Formats.cpp | 2 +- Source/Core/Core/IOS/WFS/WFSI.cpp | 2 +- Source/Core/DiscIO/VolumeWad.cpp | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Source/Core/Core/IOS/ES/Formats.cpp b/Source/Core/Core/IOS/ES/Formats.cpp index e055f72564..d041514171 100644 --- a/Source/Core/Core/IOS/ES/Formats.cpp +++ b/Source/Core/Core/IOS/ES/Formats.cpp @@ -194,7 +194,7 @@ void SignedBlobReader::DoState(PointerWrap& p) bool IsValidTMDSize(size_t size) { - return size <= 0x49e4; + return size >= sizeof(TMDHeader) && size <= 0x49e4; } TMDReader::TMDReader(std::vector bytes) : SignedBlobReader(std::move(bytes)) diff --git a/Source/Core/Core/IOS/WFS/WFSI.cpp b/Source/Core/Core/IOS/WFS/WFSI.cpp index c037967d6a..73bf030dea 100644 --- a/Source/Core/Core/IOS/WFS/WFSI.cpp +++ b/Source/Core/Core/IOS/WFS/WFSI.cpp @@ -156,7 +156,7 @@ std::optional WFSIDevice::IOCtl(const IOCtlRequest& request) if (!ES::IsValidTMDSize(tmd_size)) { - ERROR_LOG_FMT(IOS_WFS, "IOCTL_WFSI_IMPORT_TITLE_INIT: TMD size too large ({})", tmd_size); + ERROR_LOG_FMT(IOS_WFS, "IOCTL_WFSI_IMPORT_TITLE_INIT: TMD size invalid ({})", tmd_size); return_error_code = IPC_EINVAL; break; } diff --git a/Source/Core/DiscIO/VolumeWad.cpp b/Source/Core/DiscIO/VolumeWad.cpp index 39961a6c18..974592fea0 100644 --- a/Source/Core/DiscIO/VolumeWad.cpp +++ b/Source/Core/DiscIO/VolumeWad.cpp @@ -51,7 +51,7 @@ VolumeWAD::VolumeWAD(std::unique_ptr reader) : m_reader(std::move(re if (!IOS::ES::IsValidTMDSize(m_tmd_size)) { - ERROR_LOG_FMT(DISCIO, "TMD is too large: {} bytes", m_tmd_size); + ERROR_LOG_FMT(DISCIO, "TMD has an invalid size: {} bytes", m_tmd_size); return; } -- cgit v1.2.3