浏览代码

ips_layer: prevent out of bounds access with offset exceeding module size

Liam 2 年之前
父节点
当前提交
d1c99c5d52
共有 1 个文件被更改,包括 7 次插入0 次删除
  1. 7 0
      src/core/file_sys/ips_layer.cpp

+ 7 - 0
src/core/file_sys/ips_layer.cpp

@@ -73,6 +73,9 @@ VirtualFile PatchIPS(const VirtualFile& in, const VirtualFile& ips) {
         return nullptr;
 
     auto in_data = in->ReadAllBytes();
+    if (in_data.size() == 0) {
+        return nullptr;
+    }
 
     std::vector<u8> temp(type == IPSFileType::IPS ? 3 : 4);
     u64 offset = 5; // After header
@@ -88,6 +91,10 @@ VirtualFile PatchIPS(const VirtualFile& in, const VirtualFile& ips) {
         else
             real_offset = (temp[0] << 16) | (temp[1] << 8) | temp[2];
 
+        if (real_offset > in_data.size()) {
+            return nullptr;
+        }
+
         u16 data_size{};
         if (ips->ReadObject(&data_size, offset) != sizeof(u16))
             return nullptr;