Leahnaya/dolphin
1
0
Fork 0
mirror of https://github.com/dolphin-emu/dolphin.git synced 2026-08-16 15:27:11 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

GCZ: Don't trust block_num either

Browse Source 
SectorReader::ReadChunk does do some validation on it, but it only
checks against the original disc size (reported by the GCZ file).
It has no idea how many blocks the header claimed the disc had.

A maliciously crafted GCZ file could trigger read overflows off the end
of the m_block_pointers/m_hashes arrays.
This commit is contained in:
Scott Mansell
2026-07-26 18:15:07 +12:00
committed by OatmealDome
parent 2f5232fbf4
commit 8f1e33a5f4
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
Source/Core/DiscIO/CompressedBlob.cpp
View File

@@ -94,6 +94,9 @@ u64 CompressedBlobReader::GetBlockCompressedSize(u64 block_num) const
bool CompressedBlobReader::GetBlock(u64 block_num, u8* out_ptr)
{
if (block_num >= m_header.num_blocks)
return false;
bool uncompressed = false;
u64 read_size = GetBlockCompressedSize(block_num);
u64 offset = m_block_pointers[block_num] + m_data_offset;