NetPlay: Fix chunked data buffer overflow

Reported by MrSynAckster.
2026-06-20 15:15:36 +02:00
parent 747e1e0d92
commit 5aed26fb11
1 changed files with 12 additions and 0 deletions
@@ -197,6 +197,12 @@ bool DecompressPacketIntoFile(sf::Packet& packet, const std::string& file_path)
    if (!cur_len)
      break;  // We reached the end of the data stream

+    if (cur_len > in_buffer.size())
+    {
+      PanicAlertFmt("LZO error - input is too large");
+      return false;
+    }
+
    for (size_t j = 0; j < cur_len; j++)
    {
      packet >> in_buffer[j];
@@ -281,6 +287,12 @@ std::optional<std::vector<u8>> DecompressPacketIntoBuffer(sf::Packet& packet)
    if (!cur_len)
      break;  // We reached the end of the data stream

+    if (cur_len > in_buffer.size())
+    {
+      PanicAlertFmt("LZO error - input is too large");
+      return {};
+    }
+
    for (size_t j = 0; j < cur_len; j++)
    {
      packet >> in_buffer[j];