Skip to content

unself: Fix some OOB - #19177

Merged
Megamouse merged 6 commits into
RPCS3:masterfrom
Megamouse:vuni4
Aug 10, 2026
Merged

Megamouse merged 6 commits into
RPCS3:masterfrom
Megamouse:vuni4

Conversation

@Megamouse

Copy link
Copy Markdown
Contributor
  • make some parameters const
  • cache temporary buffers outside the loop
  • use ranged loops
  • ensure src buffer size + dst offset don't exceed dst buffer size
  • ensure src buffer size + dst offset don't overflow
  • use read_from_ptr for key and iv reads to prevent OOB reads when key_idx*16 exceeds the data size
  • prevent underflow: use (key_idx < key_count) instead of (key_idx <= key_count - 1)
  • fix uncompress:
    • decomp_buf_length can be smaller than the input size after uncompress, meaning that we could end up writing too much data afterwards
    • zlib_buf was a copy of the entire buffer, but then passed zlib_buf.data() + offset and zlib_buf.size() as source and sourceLen, meaning sourceLen was too large.
      Instead, now we copy the segment from offset to end and simply pass zlib_buf.data() and zlib_buf.size() as source and sourceLen

@Megamouse
Megamouse merged commit eaef23d into RPCS3:master Aug 10, 2026
10 checks passed
@Megamouse
Megamouse deleted the vuni4 branch August 10, 2026 15:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant