From 5753d99db126bca1b7f6530e0253246f2e85ac82 Mon Sep 17 00:00:00 2001
From: Megamouse <studienricky89@googlemail.com>
Date: Wed, 30 Sep 2026 00:30:36 +0200
Subject: [PATCH] cellHttpUtil: fix off by one in cellHttpUtilEscapeUri (looped
 for inSize+1)

---
 rpcs3/Emu/Cell/Modules/cellHttpUtil.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/rpcs3/Emu/Cell/Modules/cellHttpUtil.cpp b/rpcs3/Emu/Cell/Modules/cellHttpUtil.cpp
index 94b73307a0..ea35abbbad 100644
--- a/rpcs3/Emu/Cell/Modules/cellHttpUtil.cpp
+++ b/rpcs3/Emu/Cell/Modules/cellHttpUtil.cpp
@@ -507,14 +507,14 @@ error_code cellHttpUtilEscapeUri(vm::ptr<char> out, u32 outSize, vm::cptr<u8> in
 
 	u32 size_needed = 0;
 	u32 out_pos = 0;
-	s32 rindex = 0;
+	u32 in_size = 0;
 
 	if (const u32 end = in.addr() + inSize; end && end >= in.addr())
 	{
-		rindex = inSize;
+		in_size = inSize;
 	}
 
-	for (u32 pos = 0; rindex >= 0; rindex--, pos++)
+	for (u32 pos = 0; pos < in_size; pos++)
 	{
 		const char c1 = in[pos];