aboutsummaryrefslogtreecommitdiff
path: root/src/core/file_sys/cheat_engine.cpp
diff options
context:
space:
mode:
authorDuck912 <350528965+Duck912@users.noreply.github.com>2026-11-03 12:56:43 -0500
committerDuck912 <350528965+Duck912@users.noreply.github.com>2026-11-03 13:06:59 -0500
commitf9d0c802e8e4e71644bf4b7e6cceca8e6df22464 (patch)
tree74ab11bfe249617baa7f7c5b1f729eeb7538ba3e /src/core/file_sys/cheat_engine.cpp
parentf4f076fe447b2ddc158fcc12ee81ed2af2aecad7 (diff)
yuzu: bound the zip directory reads in the DLSS download
The central-directory parser trusted each entry's name, extra and comment lengths and the Zip64 extra field's length, so a malformed directory could make it read past the downloaded buffer. The data comes from NVIDIA's GitHub release over TLS and the saved files are signature-checked, so the risk is low. Stop with an error when an entry runs past the directory, and read Zip64 fields only inside their record. Found by CodeRabbit review. Assisted-by: Claude Opus 5.5 (implementation) Signed-off-by: Duck912 <350528965+Duck912@users.noreply.github.com>
Diffstat (limited to 'src/core/file_sys/cheat_engine.cpp')
0 files changed, 0 insertions, 0 deletions