mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-10-01 14:58:14 +00:00
Henrik Rydgård
bfbe44ad1c
FindNextMp3Sync() computed `sourcebuff.size() - 2` as the loop bound; when size() is 0 or 1 this underflows to a huge size_t, turning the scan into an out-of-bounds read. Reachable via sceMp3NotifyAddStreamData followed by sceMp3Decode with as little as 1 pending byte. AuNotifyAddStreamData() trusted the game-supplied `size` outright: a negative value would make sourcebuff.resize() attempt a huge allocation (via size_t underflow), an unbounded positive value grows sourcebuff without limit, and the validated range didn't match the actual read range (checked [AuBuf, AuBuf+size) while reading from [AuBuf+offset, AuBuf+offset+size)). Validate size is positive and capped to the buffer's declared capacity, and validate the range actually read.