RPCS3/rpcs3
1
0
Fork 0
mirror of https://github.com/RPCS3/rpcs3.git synced 2026-10-11 22:49:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bound PKG entry table allocation

Browse Source 
PKG file_count was used for vector allocation before validating
that the encrypted package data contained the entry table. Limit the
count and require the entry table to fit in the declared data region
before allocating.
This commit is contained in:
Acts1631
2026-09-10 18:32:18 +03:00
committed by Elad
parent 09bb101de1
commit 71e9f4ea57
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rpcs3/Crypto/unpkg.cpp
+2 -2
View File
@@ -121,9 +121,9 @@ bool package_reader::read_header()
return false;
}
if (u64{umax} / sizeof(PKGEntry) < u64(m_header.file_count))
if (m_header.file_count > PKG_MAX_FILE_COUNT || u64(m_header.file_count) > u64(m_header.data_size) / sizeof(PKGEntry))
{
pkg_log.error("PKG file count is too large! (0x%x)", m_header.file_count);
pkg_log.error("PKG file count is invalid! (count=0x%x, data_size=0x%llx)", m_header.file_count, m_header.data_size);
return false;
}
rpcs3/Crypto/unpkg.h
+1
View File
@@ -14,6 +14,7 @@ enum : u32
{
PKG_HEADER_SIZE = 0xC0, // sizeof(pkg_header) + sizeof(pkg_unk_checksum)
PKG_HEADER_SIZE2 = 0x280,
PKG_MAX_FILE_COUNT = 1'000'000,
PKG_MAX_FILENAME_SIZE = 256,
};