From 07d6d90bb3a738e88ba7edcdd9a20fd9fca923b4 Mon Sep 17 00:00:00 2001 From: Weiyi Wang Date: Sun, 9 Dec 2018 13:20:44 -0500 Subject: [PATCH] gl_rasterizer_cache/MortonCopy: avoid read/write to invalid address --- src/video_core/renderer_opengl/gl_rasterizer_cache.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/video_core/renderer_opengl/gl_rasterizer_cache.cpp b/src/video_core/renderer_opengl/gl_rasterizer_cache.cpp index 51fe40d49e..220458967a 100644 --- a/src/video_core/renderer_opengl/gl_rasterizer_cache.cpp +++ b/src/video_core/renderer_opengl/gl_rasterizer_cache.cpp @@ -147,9 +147,18 @@ static void MortonCopy(u32 stride, u32 height, u8* gl_buffer, PAddr base, PAddr } const u8* const buffer_end = tile_buffer + aligned_end - aligned_start; + PAddr current_paddr = aligned_start; while (tile_buffer < buffer_end) { + // Pokemon Super Mystery Dungeon will try to use textures that go beyond + // the end address of VRAM. Stop reading if reaches invalid address + if (!VideoCore::g_memory->IsValidPhysicalAddress(current_paddr) || + !VideoCore::g_memory->IsValidPhysicalAddress(current_paddr + tile_size)) { + LOG_ERROR(Render_OpenGL, "Out of bound texture"); + break; + } MortonCopyTile(stride, tile_buffer, gl_buffer); tile_buffer += tile_size; + current_paddr += tile_size; glbuf_next_tile(); }