From 79081ca272ebdcf1702c5d3a16a9be2538332a8a Mon Sep 17 00:00:00 2001
From: emoose <abc@cock.li>
Date: Sat, 11 Jan 2020 18:47:06 +0000
Subject: [PATCH] [Kernel/VFS] Add maximum size for thumbnails read from
 headers

---
 src/xenia/kernel/xam/content_package.cc       | 16 +++++++++-------
 src/xenia/vfs/devices/stfs_container_device.h |  3 +++
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/src/xenia/kernel/xam/content_package.cc b/src/xenia/kernel/xam/content_package.cc
index 201dbceb1..28acb22fd 100644
--- a/src/xenia/kernel/xam/content_package.cc
+++ b/src/xenia/kernel/xam/content_package.cc
@@ -118,9 +118,10 @@ X_RESULT FolderContentPackage::GetThumbnail(std::vector<uint8_t>* buffer) {
                                   sizeof(vfs::StfsHeader));
     if (map) {
       auto* header = (vfs::StfsHeader*)map->data();
-      buffer->resize(header->metadata.thumbnail_size);
-      memcpy(buffer->data(), header->metadata.thumbnail,
-             header->metadata.thumbnail_size);
+      uint32_t thumb_size = std::min((uint32_t)header->metadata.thumbnail_size,
+                                     xe::vfs::XContentMetadata::kThumbLengthV1);
+      buffer->resize(thumb_size);
+      memcpy(buffer->data(), header->metadata.thumbnail, thumb_size);
       result = X_ERROR_SUCCESS;
     }
   }
@@ -171,14 +172,15 @@ X_RESULT StfsContentPackage::GetThumbnail(std::vector<uint8_t>* buffer) {
   if (!device_inited_) {
     return X_ERROR_DEVICE_NOT_CONNECTED;
   }
-  buffer->resize(header_.metadata.thumbnail_size);
-  memcpy(buffer->data(), header_.metadata.thumbnail,
-         header_.metadata.thumbnail_size);
+  uint32_t thumb_size = std::min((uint32_t)header_.metadata.thumbnail_size,
+                                 xe::vfs::XContentMetadata::kThumbLengthV1);
+  buffer->resize(thumb_size);
+  memcpy(buffer->data(), header_.metadata.thumbnail, thumb_size);
   return X_ERROR_SUCCESS;
 }
 
 X_RESULT StfsContentPackage::SetThumbnail(std::vector<uint8_t> buffer) {
-  return X_ERROR_FUNCTION_FAILED;  // can't write to STFS headers right now
+  return X_ERROR_FUNCTION_FAILED;  // can't write to STFS package right now
 }
 
 X_RESULT StfsContentPackage::Delete() {
diff --git a/src/xenia/vfs/devices/stfs_container_device.h b/src/xenia/vfs/devices/stfs_container_device.h
index 430a3321d..0a7afd6b7 100644
--- a/src/xenia/vfs/devices/stfs_container_device.h
+++ b/src/xenia/vfs/devices/stfs_container_device.h
@@ -167,6 +167,9 @@ enum class XContentVolumeType : uint32_t {
 };
 
 struct XContentMetadata {
+  static const uint32_t kThumbLength = 0x3D00;
+  static const uint32_t kThumbLengthV1 = 0x4000;
+
   xe::be<XContentType> content_type;
   xe::be<uint32_t> metadata_version;
   xe::be<uint64_t> content_size;