mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-10-01 14:58:14 +00:00
Henrik RydgårdandClaude Sonnet 5
1eab737e4d
DoVector already rejects an attacker/corruption-controlled size that would resize far beyond what's actually left in the savestate buffer. DoList/DoDeque/DoMap/DoMultimap/DoSet never got the same treatment - a corrupted count field (e.g. 0xFFFFFFFF) drove an immediate huge resize (list/deque) or an unbounded loop of allocations (map/set) before any per-element bounds checking kicked in. All five now check the declared count against PointerWrap::Remaining() first. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01L4QAoxV2KY7ek4PcZw3WvY