Crafted title IDs could escape serial-derived directories and redirect
recursive cache cleanup outside RPCS3's cache root. Reject structural
path components, escape identifiers used as host names, and make
cleanup matching literal and exact.
Analysis and fixes made by Opus 5.5.
## Bug
`cellSearchGetMusicSelectionContext` only put the selected (or a random)
track into the context, even when the search contained many tracks.
Games that pick custom music through cellSearch got a one-track
playlist, so with repeat ALL the same song played on loop forever.
## Fix
- For a search of single tracks the playlist now contains every track of
the search, and `first_track` / `current_track` point to the selected
one (random when shuffled, otherwise the first).
- `music_selection_context::find_content_id` starts from the selected
track instead of the first entry of the playlist.
- `audio_decoder` keeps the selected track first when shuffling and only
shuffles the rest.
Tested with NHL 14.
Fixes#14738
Part of #18779, #11596
---------
Co-authored-by: Claude Opus 5.5 <[email protected]>
RPCN forwards MessageDetails from other users. The protobuf uint16
wrappers can carry 32-bit values, and narrowing them on the recipient
aborts RPCS3.
Validate both values before casting so malformed messages are
discarded.
RPCN room peers control message payloads and destination lists. Values
above the Matching2 limits overflow the recipient's fixed event buffer
and terminate the NP handler.
Reject malformed room message notifications before allocating event
data.
Signaling peers control the timestamps used for RTT calculation. A
future timestamp wraps the unsigned delta, and the fatal checked cast
terminates the signaling thread.
Reject future and oversized RTT values before updating peer state.
The resampler buffers part of its input whenever the file's sample rate differs from the 48 kHz output,
because the output buffer was only sized for the frame's own samples. These samples piled up and were
never flushed, so a 44.1 kHz track came out 8.125% short (5-20 s cut from the end of every song).
The decoder itself was never drained either.
- Size the output for the pending resampler samples too and only append what swr_convert actually wrote.
- Flush the decoder and the resampler once the last packet has been read.
- Reserve the whole track up front, reuse the resampler output buffer and byteswap in place before
appending, instead of growing the track buffer and allocating a buffer for every frame.
Fixes#18930 (custom music cut in Gran Turismo 5).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Qt's QTabWidget only intercepts Ctrl+Tab/Ctrl+Shift+Tab while the tab
widget itself has keyboard focus. The dialog's own currentChanged
handler moves focus to the Close button after every tab switch, and
clicking into a tab's content moves focus to a child widget, so the
shortcut stopped working after the first switch.
Add explicit window-scoped shortcuts that cycle the tab index
directly, so Ctrl+Tab/Ctrl+Shift+Tab keep working regardless of which
widget currently has focus.
Fixes#19425
Co-Authored-By: Claude Sonnet 5 <[email protected]>
This is the only known function that passes arguments in vector
registers.
Although we had an implementation for it, it was never used before.
Hopefully it works.
Attempting to fix "invalid" argument passed to cellGemSetYaw due to
wrong register decoding.
Acts1631