From 07d6d90bb3a738e88ba7edcdd9a20fd9fca923b4 Mon Sep 17 00:00:00 2001
From: Weiyi Wang <wwylele@gmail.com>
Date: Sun, 9 Dec 2018 13:20:44 -0500
Subject: [PATCH] gl_rasterizer_cache/MortonCopy: avoid read/write to invalid
address
---
src/video_core/renderer_opengl/gl_rasterizer_cache.cpp | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/src/video_core/renderer_opengl/gl_rasterizer_cache.cpp b/src/video_core/renderer_opengl/gl_rasterizer_cache.cpp
index 51fe40d49e..220458967a 100644
--- a/src/video_core/renderer_opengl/gl_rasterizer_cache.cpp
+++ b/src/video_core/renderer_opengl/gl_rasterizer_cache.cpp
@@ -147,9 +147,18 @@ static void MortonCopy(u32 stride, u32 height, u8* gl_buffer, PAddr base, PAddr
}
const u8* const buffer_end = tile_buffer + aligned_end - aligned_start;
+ PAddr current_paddr = aligned_start;
while (tile_buffer < buffer_end) {
+ // Pokemon Super Mystery Dungeon will try to use textures that go beyond
+ // the end address of VRAM. Stop reading if reaches invalid address
+ if (!VideoCore::g_memory->IsValidPhysicalAddress(current_paddr) ||
+ !VideoCore::g_memory->IsValidPhysicalAddress(current_paddr + tile_size)) {
+ LOG_ERROR(Render_OpenGL, "Out of bound texture");
+ break;
+ }
MortonCopyTile<morton_to_gl, format>(stride, tile_buffer, gl_buffer);
tile_buffer += tile_size;
+ current_paddr += tile_size;
glbuf_next_tile();
}