From b64bb2e8ce93a5fc9566e73bb74827a7664c97fa Mon Sep 17 00:00:00 2001 From: "Unknown W. Brackets" Date: Sat, 11 Aug 2018 16:52:44 -0700 Subject: [PATCH] Savedata: Also validate icon/subdata size. --- Core/Dialog/SavedataParam.cpp | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/Core/Dialog/SavedataParam.cpp b/Core/Dialog/SavedataParam.cpp index a6240ac13a..a137e779f7 100644 --- a/Core/Dialog/SavedataParam.cpp +++ b/Core/Dialog/SavedataParam.cpp @@ -366,6 +366,17 @@ int SavedataParam::Save(SceUtilitySavedataParam* param, const std::string &saveD ERROR_LOG_REPORT(SCEUTILITY, "Savedata buffer overflow: %d / %d", param->dataSize, param->dataBufSize); return SCE_UTILITY_SAVEDATA_ERROR_RW_BAD_PARAMS; } + auto validateSize = [](const PspUtilitySavedataFileData &data) { + if (data.buf.IsValid() && data.bufSize < data.size) { + ERROR_LOG_REPORT(SCEUTILITY, "Savedata subdata buffer overflow: %d / %d", data.size, data.bufSize); + return false; + } + return true; + }; + if (!validateSize(param->icon0FileData) || !validateSize(param->icon1FileData) || !validateSize(param->pic1FileData) || !validateSize(param->snd0FileData)) { + return SCE_UTILITY_SAVEDATA_ERROR_RW_BAD_PARAMS; + } + if (param->secureVersion > 3) { ERROR_LOG_REPORT(SCEUTILITY, "Savedata version requested on save: %d", param->secureVersion); return SCE_UTILITY_SAVEDATA_ERROR_SAVE_PARAM;