From 31eaf1d67c11f4f0036c198b2b1a7bc11c8dec5a Mon Sep 17 00:00:00 2001 From: JosJuice Date: Sat, 30 May 2026 15:50:06 +0200 Subject: [PATCH] EXI/BBA: Fix tx_fifo memory safety issues Reported by MrSynAckster. --- Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp b/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp index c49c6e32b9..631913f2d5 100644 --- a/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp +++ b/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp @@ -435,7 +435,11 @@ void CEXIETHERNET::DirectFIFOWrite(const u8* data, u32 size) // GMAC instead of finagling with packet descriptors and such u16* tx_fifo_count = (u16*)&mBbaMem[BBA_TXFIFOCNT]; - memcpy(tx_fifo.get() + *tx_fifo_count, data, size); + if (*tx_fifo_count < BBA_TXFIFO_SIZE) + { + const u32 max_size = BBA_TXFIFO_SIZE - *tx_fifo_count; + memcpy(tx_fifo.get() + *tx_fifo_count, data, std::min(size, max_size)); + } *tx_fifo_count += size; // TODO: not sure this mask is correct. @@ -447,7 +451,7 @@ void CEXIETHERNET::DirectFIFOWrite(const u8* data, u32 size) void CEXIETHERNET::SendFromDirectFIFO() { const u8* frame = tx_fifo.get(); - const u16 size = Common::BitCastPtr(&mBbaMem[BBA_TXFIFOCNT]); + const u16 size = std::min(BBA_TXFIFO_SIZE, Common::BitCastPtr(&mBbaMem[BBA_TXFIFOCNT])); if (m_network_interface->SendFrame(frame, size)) m_system.GetPowerPC().GetDebugInterface().NetworkLogger()->LogBBA(frame, size); }