From 56e8b740f18e4bac898a69918fc1f2b411b943f7 Mon Sep 17 00:00:00 2001
From: JosJuice <josjuice@gmail.com>
Date: Sun, 20 Sep 2026 20:13:19 +0200
Subject: [PATCH] GCMemcardDirectory: Add bounds check for m_save_data

---
 Source/Core/Core/HW/GCMemcard/GCMemcardDirectory.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Source/Core/Core/HW/GCMemcard/GCMemcardDirectory.cpp b/Source/Core/Core/HW/GCMemcard/GCMemcardDirectory.cpp
index 791b471be4..c8d4447f4e 100644
--- a/Source/Core/Core/HW/GCMemcard/GCMemcardDirectory.cpp
+++ b/Source/Core/Core/HW/GCMemcard/GCMemcardDirectory.cpp
@@ -553,6 +553,12 @@ inline s32 GCMemcardDirectory::SaveAreaRW(u32 block, bool writing)
           m_saves[i].m_dirty = true;
         }
 
+        if (static_cast<size_t>(idx) >= m_saves[i].m_save_data.size())
+        {
+          PanicAlertFmt("Block index ({0}) is larger than the number of available blocks ({1})",
+                        idx, m_saves[i].m_save_data.size());
+          return -1;
+        }
         m_last_block = block;
         m_last_block_address = m_saves[i].m_save_data[idx].m_block.data();
         return m_last_block;