Leahnaya/dolphin
1
0
Fork 0
mirror of https://github.com/dolphin-emu/dolphin.git synced 2026-08-06 20:30:27 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

HW/DSPHLE/AXVoice: Check array bounds in ApplyUpdatesForMs()

Browse Source 
Fixes https://github.com/dolphin-emu/dolphin/security/advisories/GHSA-4q28-hhjv-hf3f
This commit is contained in:
Admiral H. Curtiss 2026-07-22 03:21:19 +02:00
parent b008142f72
commit d5d2f7c8fb
No known key found for this signature in database
GPG Key ID: F051B4C4044F33FB
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Source/Core/Core/HW/DSPHLE/UCodes/AXVoice.h
View File

@ -65,12 +65,21 @@ void ApplyUpdatesForMs(int curr_ms, PB_TYPE& pb, u16* num_updates, const PBUpdat
for (int i = 0; i < curr_ms; ++i)
start_idx += num_updates[i];
for (u32 i = start_idx; i < start_idx + num_updates[curr_ms]; ++i)
if (start_idx < updates.size())
{
u16 update_off = updates[i].pb_offset;
u16 update_val = updates[i].new_value;
const u16 count = num_updates[curr_ms];
if (count <= updates.size() - start_idx)
{
const u32 end_idx = start_idx + count;
for (u32 i = start_idx; i < end_idx; ++i)
{
const u16 update_off = updates[i].pb_offset;
const u16 update_val = updates[i].new_value;
pb_mem[update_off] = update_val;
if (update_off < pb_mem.size())
pb_mem[update_off] = update_val;
}
}
}
pb = std::bit_cast<PB_TYPE>(pb_mem);