Stay in bounds
This commit is contained in:
		| @@ -557,6 +557,9 @@ void NCCHContainer::ApplyIPS(std::vector<u8>& ips, std::vector<u8>& buffer) { | |||||||
|         if (length == 0) { |         if (length == 0) { | ||||||
|             length = ips[cursor + 5] << 8 | ips[cursor + 6]; |             length = ips[cursor + 5] << 8 | ips[cursor + 6]; | ||||||
|  |  | ||||||
|  |             if (buffer.size() < offset + length) | ||||||
|  |                 return; | ||||||
|  |  | ||||||
|             for (u32 i = 0; i < length; ++i) |             for (u32 i = 0; i < length; ++i) | ||||||
|                 buffer[offset + i] = ips[cursor + 7]; |                 buffer[offset + i] = ips[cursor + 7]; | ||||||
|  |  | ||||||
| @@ -565,6 +568,9 @@ void NCCHContainer::ApplyIPS(std::vector<u8>& ips, std::vector<u8>& buffer) { | |||||||
|             continue; |             continue; | ||||||
|         } |         } | ||||||
|  |  | ||||||
|  |         if (buffer.size() < offset + length) | ||||||
|  |             return; | ||||||
|  |  | ||||||
|         std::memcpy(&buffer[offset], &ips[cursor + 5], length); |         std::memcpy(&buffer[offset], &ips[cursor + 5], length); | ||||||
|         cursor += length + 5; |         cursor += length + 5; | ||||||
|     } |     } | ||||||
|   | |||||||
		Reference in New Issue
	
	Block a user
	 Zak Kurka
					Zak Kurka