From 32d9a83f8e80ef34f79123d6cddeeb3e6454be80 Mon Sep 17 00:00:00 2001 From: Alessandro Astone Date: Fri, 5 Feb 2021 00:34:09 +0100 Subject: [PATCH] pl_u: Fix read out of bounds --- src/core/hle/service/ns/pl_u.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/core/hle/service/ns/pl_u.cpp b/src/core/hle/service/ns/pl_u.cpp index 71c7587dbd..b6ac0a81aa 100644 --- a/src/core/hle/service/ns/pl_u.cpp +++ b/src/core/hle/service/ns/pl_u.cpp @@ -65,13 +65,18 @@ static void DecryptSharedFont(const std::vector& input, Kernel::PhysicalMem void DecryptSharedFontToTTF(const std::vector& input, std::vector& output) { ASSERT_MSG(input[0] == EXPECTED_MAGIC, "Failed to derive key, unexpected magic number"); + if (input.size() < 2) { + LOG_ERROR(Service_NS, "Input font is empty"); + return; + } + const u32 KEY = input[0] ^ EXPECTED_RESULT; // Derive key using an inverse xor std::vector transformed_font(input.size()); // TODO(ogniK): Figure out a better way to do this std::transform(input.begin(), input.end(), transformed_font.begin(), [&KEY](u32 font_data) { return Common::swap32(font_data ^ KEY); }); - transformed_font[1] = Common::swap32(transformed_font[1]) ^ KEY; // "re-encrypt" the size - std::memcpy(output.data(), transformed_font.data() + 2, transformed_font.size() * sizeof(u32)); + std::memcpy(output.data(), transformed_font.data() + 2, + (transformed_font.size() - 2) * sizeof(u32)); } void EncryptSharedFont(const std::vector& input, std::vector& output,