mirror of
https://github.com/dolphin-emu/dolphin.git
synced 2026-10-12 02:13:17 +00:00
Acts1631
2eea927e95
Save states restored video FIFO pointers from unchecked offsets. A crafted offset could place a pointer outside its backing allocation and turn the next gather-pipe copy into an out-of-bounds native write. Require pointer offsets to stay within their backing array and reject a state when either offset is invalid or the read pointer follows the write pointer.