Vulnerability fixes (2/3) - #22012

Merged

hrydgard merged 16 commits into

Aug 1, 2026

Commits on Aug 1, 2026

Fix mismatched new[]/delete in CachingFileLoader cache eviction
hrydgard
committed
a0fe36f
Limit PNG decode dimensions to prevent decompression bombs
hrydgard
committed
a7b1b31
Skip savestate migration if game ID strings contain a path separator
hrydgard
committed
c0f5b3d
Clamp partial packet copy to main buffer size in Atrac2::DecodeInternal
hrydgard
committed
3ad0837
Add bounds checking to savestate deserialization
hrydgard
committed
58d4759
Fix null pointer deref in AtracSasAddStreamData
hrydgard
committed
398a678
Reject ATRAC files with oversized packets at parse time; honor Verify errors
hrydgard
committed
2100e4e
Fix OOB read on unterminated module names in PRX import debug reporter
hrydgard
committed
983068b
Fix integer overflow in PMF video frame buffer allocation
hrydgard
committed
5d10f28
Clamp HTTP response body to the requested range in HTTPFileLoader
hrydgard
committed
a8195e7
Fix out-of-bounds reads in PGF font parsing
hrydgard
committed
788150c
Bounds-check charPtr inside PGF::ReadCharGlyph
hrydgard
committed
04d8613
Fix EP-map parsing OOB read in PSMF video stream params
hrydgard
committed
32abdd6
Fix out-of-bounds reads in ATRAC track parsing
hrydgard
committed
4cd611b
Bump actions/setup-java from 5 to 5.6.0

dependabot[bot]
authored and
hrydgard
committed
6ef7e23
Bump softprops/action-gh-release from 3.0.1 to 3.0.2

dependabot[bot]
authored and
hrydgard
committed
a456c2c