From 72ad15458e0dc9bb29f70cc1103ea9bb22a0637e Mon Sep 17 00:00:00 2001 From: Jamiras Date: Sat, 4 Nov 2023 12:40:39 -0600 Subject: [PATCH] prevent write-past-end-of-buffer when signed value wraps --- deps/rcheevos/src/rcheevos/alloc.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/deps/rcheevos/src/rcheevos/alloc.c b/deps/rcheevos/src/rcheevos/alloc.c index 7c2af1f38af..a4ebdbf66b6 100644 --- a/deps/rcheevos/src/rcheevos/alloc.c +++ b/deps/rcheevos/src/rcheevos/alloc.c @@ -22,11 +22,13 @@ void* rc_alloc_scratch(void* pointer, int32_t* offset, uint32_t size, uint32_t a buffer = &scratch->buffer; do { const uint32_t aligned_buffer_offset = (buffer->offset + alignment - 1) & ~(alignment - 1); - const uint32_t remaining = sizeof(buffer->buffer) - aligned_buffer_offset; + if (aligned_buffer_offset < sizeof(buffer->buffer)) { + const uint32_t remaining = sizeof(buffer->buffer) - aligned_buffer_offset; - if (remaining >= size) { - /* claim the required space from an existing buffer */ - return rc_alloc(buffer->buffer, &buffer->offset, size, alignment, NULL, -1); + if (remaining >= size) { + /* claim the required space from an existing buffer */ + return rc_alloc(buffer->buffer, &buffer->offset, size, alignment, NULL, -1); + } } if (!buffer->next)