From d25011c92fe4ab7bf00e7273a3a4daa9b9d05a2b Mon Sep 17 00:00:00 2001
From: bunnei <bunneidev@gmail.com>
Date: Sat, 13 Feb 2021 02:30:33 -0800
Subject: [PATCH] hle: service: am: IStorageAccessor: Fix out of bounds error
 handling.

---
 src/core/hle/service/am/am.cpp | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/core/hle/service/am/am.cpp b/src/core/hle/service/am/am.cpp
index bb77c2569..8e1fe9438 100644
--- a/src/core/hle/service/am/am.cpp
+++ b/src/core/hle/service/am/am.cpp
@@ -1047,20 +1047,21 @@ void IStorageAccessor::Write(Kernel::HLERequestContext& ctx) {
 
     const u64 offset{rp.Pop<u64>()};
     const std::vector<u8> data{ctx.ReadBuffer()};
+    const std::size_t size{std::min(data.size(), backing.GetSize() - offset)};
 
-    LOG_DEBUG(Service_AM, "called, offset={}, size={}", offset, data.size());
+    LOG_DEBUG(Service_AM, "called, offset={}, size={}", offset, size);
 
-    if (data.size() > backing.GetSize() - offset) {
+    if (offset > backing.GetSize()) {
         LOG_ERROR(Service_AM,
                   "offset is out of bounds, backing_buffer_sz={}, data_size={}, offset={}",
-                  backing.GetSize(), data.size(), offset);
+                  backing.GetSize(), size, offset);
 
         IPC::ResponseBuilder rb{ctx, 2};
         rb.Push(ERR_SIZE_OUT_OF_BOUNDS);
         return;
     }
 
-    std::memcpy(backing.GetData().data() + offset, data.data(), data.size());
+    std::memcpy(backing.GetData().data() + offset, data.data(), size);
 
     IPC::ResponseBuilder rb{ctx, 2};
     rb.Push(RESULT_SUCCESS);
@@ -1070,11 +1071,11 @@ void IStorageAccessor::Read(Kernel::HLERequestContext& ctx) {
     IPC::RequestParser rp{ctx};
 
     const u64 offset{rp.Pop<u64>()};
-    const std::size_t size{ctx.GetWriteBufferSize()};
+    const std::size_t size{std::min(ctx.GetWriteBufferSize(), backing.GetSize() - offset)};
 
     LOG_DEBUG(Service_AM, "called, offset={}, size={}", offset, size);
 
-    if (size > backing.GetSize() - offset) {
+    if (offset > backing.GetSize()) {
         LOG_ERROR(Service_AM, "offset is out of bounds, backing_buffer_sz={}, size={}, offset={}",
                   backing.GetSize(), size, offset);