From 8f1e33a5f47dc350dc32f168252ecb2eba9ed2a2 Mon Sep 17 00:00:00 2001 From: Scott Mansell Date: Sun, 26 Jul 2026 18:15:07 +1200 Subject: [PATCH] GCZ: Don't trust block_num either SectorReader::ReadChunk does do some validation on it, but it only checks against the original disc size (reported by the GCZ file). It has no idea how many blocks the header claimed the disc had. A maliciously crafted GCZ file could trigger read overflows off the end of the m_block_pointers/m_hashes arrays. --- Source/Core/DiscIO/CompressedBlob.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Source/Core/DiscIO/CompressedBlob.cpp b/Source/Core/DiscIO/CompressedBlob.cpp index eae4d4ccaf..036e139d0b 100644 --- a/Source/Core/DiscIO/CompressedBlob.cpp +++ b/Source/Core/DiscIO/CompressedBlob.cpp @@ -94,6 +94,9 @@ u64 CompressedBlobReader::GetBlockCompressedSize(u64 block_num) const bool CompressedBlobReader::GetBlock(u64 block_num, u8* out_ptr) { + if (block_num >= m_header.num_blocks) + return false; + bool uncompressed = false; u64 read_size = GetBlockCompressedSize(block_num); u64 offset = m_block_pointers[block_num] + m_data_offset;