Crafted title IDs could escape serial-derived directories and redirect
recursive cache cleanup outside RPCS3's cache root. Reject structural
path components, escape identifiers used as host names, and make
cleanup matching literal and exact.
RPCN forwards MessageDetails from other users. The protobuf uint16
wrappers can carry 32-bit values, and narrowing them on the recipient
aborts RPCS3.
Validate both values before casting so malformed messages are
discarded.
RPCN room peers control message payloads and destination lists. Values
above the Matching2 limits overflow the recipient's fixed event buffer
and terminate the NP handler.
Reject malformed room message notifications before allocating event
data.
Signaling peers control the timestamps used for RTT calculation. A
future timestamp wraps the unsigned delta, and the fatal checked cast
terminates the signaling thread.
Reject future and oversized RTT values before updating peer state.
PKG file_count was used for vector allocation before validating
that the encrypted package data contained the entry table. Limit the
count and require the entry table to fit in the declared data region
before allocating.
PKG entry names could contain traversal components and escape the
installation directory. Reject absolute and special components, then
require the resolved target to remain below the installation root
before creating or writing files.
Acts1631