diff options
| author | Duck912 <350528965+Duck912@users.noreply.github.com> | 2026-11-03 12:56:43 -0500 |
|---|---|---|
| committer | Duck912 <350528965+Duck912@users.noreply.github.com> | 2026-11-03 13:06:59 -0500 |
| commit | f9d0c802e8e4e71644bf4b7e6cceca8e6df22464 (patch) | |
| tree | 74ab11bfe249617baa7f7c5b1f729eeb7538ba3e /docs/Debug.md | |
| parent | f4f076fe447b2ddc158fcc12ee81ed2af2aecad7 (diff) | |
yuzu: bound the zip directory reads in the DLSS download
The central-directory parser trusted each entry's name, extra and comment lengths and the Zip64
extra field's length, so a malformed directory could make it read past the downloaded buffer. The
data comes from NVIDIA's GitHub release over TLS and the saved files are signature-checked, so the
risk is low.
Stop with an error when an entry runs past the directory, and read Zip64 fields only inside their
record.
Found by CodeRabbit review.
Assisted-by: Claude Opus 5.5 (implementation)
Signed-off-by: Duck912 <350528965+Duck912@users.noreply.github.com>
Diffstat (limited to 'docs/Debug.md')
0 files changed, 0 insertions, 0 deletions
