LibretroAdmin f726f0955a libchdr: bound totalhunks before allocating the v3/v4 hunk map ...

map_read sized chd->map as sizeof(map_entry) * totalhunks straight from
the header. With a 32-bit size_t the product wraps (0x0CCCCCCD hunks of
the 20-byte i386 entry allocate 4 bytes), and the extraction loop then
writes a full 512-entry chunk past the end of the buffer.

The map follows the header as one record per hunk plus the end-of-list
cookie, so the file size now bounds the count, and the count must also
keep the allocation inside size_t; either failure is CHDERR_INVALID_DATA
before anything is allocated. Regression lane chd_map_alloc_test opens
v3/v4 images from memory, including both wrapping counts with a full
map chunk present.

2026-11-06 23:51:11 +01:00

..

ISSUE_TEMPLATE

Language update (#17418)

2025-01-16 20:00:16 +01:00

workflows

libchdr: bound totalhunks before allocating the v3/v4 hunk map

2026-11-06 23:51:11 +01:00

FUNDING.yml

Update FUNDING.yml

2020-03-14 02:53:46 +01:00

PULL_REQUEST_TEMPLATE.md

Update PULL_REQUEST_TEMPLATE.md (#18649)

2026-01-28 02:35:53 +01:00