PCSX2/pcsx2
1
0
Fork 0
mirror of https://github.com/PCSX2/pcsx2.git synced 2026-10-11 22:49:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Memcard: Reject accesses to reserved clusters in folder memcards

Browse Source 
Reads and writes below the allocation offset or past the allocation end
wrapped the FAT cluster subtraction and read out of bounds.

Fixes #14890.
This commit is contained in:
shawly
2026-10-07 14:10:14 -04:00
committed by Ty
parent 874b5ab1e1
commit 161a6cd219
1 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pcsx2/SIO/Memcard/MemoryCardFolder.cpp
+18 -2
View File
@@ -897,7 +897,15 @@ bool FolderMemoryCard::ReadFromFile(u8* dest, u32 adr, u32 dataLength)
const u32 page = adr / PageSizeRaw;
const u32 offset = adr % PageSizeRaw;
const u32 cluster = adr / ClusterSizeRaw;
const u32 fatCluster = cluster - m_superBlock.data.alloc_offset;
const u32 startDataCluster = m_superBlock.data.alloc_offset;
const u32 endDataCluster = startDataCluster + m_superBlock.data.alloc_end;
if (cluster < startDataCluster || cluster >= endDataCluster)
{
return false;
}
const u32 fatCluster = cluster - startDataCluster;
// if the cluster is unused according to FAT, just return
if ((m_fat.data[0][0][fatCluster] & DataClusterInUseMask) == 0)
@@ -1503,7 +1511,15 @@ bool FolderMemoryCard::WriteToFile(const u8* src, u32 adr, u32 dataLength)
const u32 cluster = adr / ClusterSizeRaw;
const u32 page = adr / PageSizeRaw;
const u32 offset = adr % PageSizeRaw;
const u32 fatCluster = cluster - m_superBlock.data.alloc_offset;
const u32 startDataCluster = m_superBlock.data.alloc_offset;
const u32 endDataCluster = startDataCluster + m_superBlock.data.alloc_end;
if (cluster < startDataCluster || cluster >= endDataCluster)
{
return false;
}
const u32 fatCluster = cluster - startDataCluster;
// if the cluster is unused according to FAT, just skip all this, we're not gonna find anything anyway
if ((m_fat.data[0][0][fatCluster] & DataClusterInUseMask) == 0)