- Real hardware behavior for constants table access is complicated.
1. If you try to encode access of c[N] where N > 467 you read back 0 in the shader
2. If you try to bypass the limitation using ARL then the index wraps around 512.
3. Using the ARL bypass between 468 and 512 returns garbage.
Crafted title IDs could escape serial-derived directories and redirect
recursive cache cleanup outside RPCS3's cache root. Reject structural
path components, escape identifiers used as host names, and make
cleanup matching literal and exact.
Analysis and fixes made by Opus 5.5.
## Bug
`cellSearchGetMusicSelectionContext` only put the selected (or a random)
track into the context, even when the search contained many tracks.
Games that pick custom music through cellSearch got a one-track
playlist, so with repeat ALL the same song played on loop forever.
## Fix
- For a search of single tracks the playlist now contains every track of
the search, and `first_track` / `current_track` point to the selected
one (random when shuffled, otherwise the first).
- `music_selection_context::find_content_id` starts from the selected
track instead of the first entry of the playlist.
- `audio_decoder` keeps the selected track first when shuffling and only
shuffles the rest.
Tested with NHL 14.
Fixes#14738
Part of #18779, #11596
---------
Co-authored-by: Claude Opus 5.5 <[email protected]>
RPCN forwards MessageDetails from other users. The protobuf uint16
wrappers can carry 32-bit values, and narrowing them on the recipient
aborts RPCS3.
Validate both values before casting so malformed messages are
discarded.
RPCN room peers control message payloads and destination lists. Values
above the Matching2 limits overflow the recipient's fixed event buffer
and terminate the NP handler.
Reject malformed room message notifications before allocating event
data.
Signaling peers control the timestamps used for RTT calculation. A
future timestamp wraps the unsigned delta, and the fatal checked cast
terminates the signaling thread.
Reject future and oversized RTT values before updating peer state.
The resampler buffers part of its input whenever the file's sample rate differs from the 48 kHz output,
because the output buffer was only sized for the frame's own samples. These samples piled up and were
never flushed, so a 44.1 kHz track came out 8.125% short (5-20 s cut from the end of every song).
The decoder itself was never drained either.
- Size the output for the pending resampler samples too and only append what swr_convert actually wrote.
- Flush the decoder and the resampler once the last packet has been read.
- Reserve the whole track up front, reuse the resampler output buffer and byteswap in place before
appending, instead of growing the track buffer and allocating a buffer for every frame.
Fixes#18930 (custom music cut in Gran Turismo 5).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Malcolm