From c7553abe894ddac84fe8417a12ec51d5ab60dc58 Mon Sep 17 00:00:00 2001 From: ameerj <52414509+ameerj@users.noreply.github.com> Date: Tue, 19 Jan 2021 19:54:28 -0500 Subject: [PATCH] astc_decoder: Fix out of bounds memory access resolves a crash with some anamolous textures found in Astral Chain. --- src/video_core/host_shaders/astc_decoder.comp | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/video_core/host_shaders/astc_decoder.comp b/src/video_core/host_shaders/astc_decoder.comp index 2ddac2e1d5..5be716309a 100644 --- a/src/video_core/host_shaders/astc_decoder.comp +++ b/src/video_core/host_shaders/astc_decoder.comp @@ -339,6 +339,9 @@ uint Select2DPartition(uint seed, uint x, uint y, uint partition_count, bool sma } uint ReadBit() { + if (current_index >= local_buff.length()) { + return 0; + } uint bit = bitfieldExtract(local_buff[current_index], bitsread, 1); bitsread++; total_bitsread++; @@ -1170,12 +1173,17 @@ void DecompressBlock(ivec3 coord, uint block_index) { plane_selector_bits = 2; } remaining_bits -= plane_selector_bits; + if (remaining_bits > 128) { + // Bad data, more remaining bits than 4 bytes + // return early + return; + } // Read color data... uint color_data_bits = remaining_bits; while (remaining_bits > 0) { - uint nb = min(remaining_bits, 8); + int nb = int(min(remaining_bits, 8U)); uint b = StreamBits(nb); - color_endpoint_data[ced_pointer] = uint(bitfieldExtract(b, 0, 8)); + color_endpoint_data[ced_pointer] = uint(bitfieldExtract(b, 0, nb)); ced_pointer++; remaining_bits -= nb; }