Vulnerability fixes (3/3) - #22014
Merged
Merged
Conversation
gameName/saveName/fileName and the saveNameList entries are
guest-controlled and get concatenated into host filesystem paths, so a
crafted request could escape the save directory with ../ sequences.
- PSPSaveDialog::Init rejects requests whose name fields contain a path
separator ('/' or '\') or are bare dot components.
- SavedataParam::SetPspParam rejects saveNameList entries the same way.
Replace the inline lambdas in the savedata dialog with the new HasPathTraversal() helper in Core/Util/PathUtil.
SeekFile stored a signed s32 position into the unsigned size_t seekPos, so a negative position (e.g. from a truncating s32 cast of a large lseek offset) wrapped seekPos to near 2^64. ReadFile's clamp arithmetic then also wrapped, driving a memcpy from a wild pointer. - Clamp the computed seek position to 0 in SeekFile. - Clamp the read size against the remaining data in ReadFile, returning 0 when seekPos is at or past the end.
ExtractZipContents wrote every entry's declared size with no ceiling, so a small high-ratio zip could decompress to fill the storage device. - Add a maxTotalSize parameter to ExtractZipContents (default 4GB) and ExtractFile. - Bail out in the size-summation pass when the total declared size exceeds the limit, and again per write chunk in case declared sizes are inaccurate.
The space-left clamp was computed in unsigned 32-bit arithmetic, so a crafted fileoffset/FirstOffsetExtra could underflow to a huge value and leave addbytes unclamped, driving a Memory::Memcpy past dataBuf_. Compute the clamp in signed 64-bit, clamp negatives to 0, and skip the copy when there's nothing to write.
nm.nsegment is attacker-controlled but segmentaddr/segmentsize are fixed 4-entry arrays; the debug info loop read past them. Clamp to 4 like the other consumers.
… savestate migration Texture pack filenames/aliases from textures.ini were used to build read and write paths with no '..' check, letting a malicious pack read or write files outside the pack directory. - LoadIniValues rejects entries with a parent dir component via HasParentDirComponent. - ReplacedTexture::Prepare skips such filenames as defense in depth. - PSPLoaders savestate migration now uses the shared HasPathTraversal helper instead of inline separator checks.
Vuln 17: ReplacedTexture::LoadLevelData let a KTX2/DDS file at a higher mip level resize the shared data_ vector to its own (attacker-controlled) mip count, so data_[mipLevel + i] indexed out of bounds and the KTX2 branch resized a different element than it wrote to. Disallow mixing image formats across mip levels, cap the container mip count, and resize the same element that is used as the transcode destination. Vuln 18: DecodeTextureLevel only validated the start address for non-DXT textures, so guest-controlled w/h/bufw could drive reads past mapped RAM. Validate the needed range like the DXT path does and clamp the height; ReadIndexedTex now takes the clamped w/h.
|
O jogo tá travando demais Midnight Club 3 DUB Edition e também o PSP fica saindo sozinho mesmo assim se eu desativar continua saindo e esse jogo que eu levei você tá travando antes não travava quando o Java versão do site |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Made in a similar way.