From c7553abe894ddac84fe8417a12ec51d5ab60dc58 Mon Sep 17 00:00:00 2001
From: ameerj <52414509+ameerj@users.noreply.github.com>
Date: Tue, 19 Jan 2021 19:54:28 -0500
Subject: astc_decoder: Fix out of bounds memory access

resolves a crash with some anamolous textures found in Astral Chain.
---
 src/video_core/host_shaders/astc_decoder.comp | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/video_core/host_shaders/astc_decoder.comp b/src/video_core/host_shaders/astc_decoder.comp
index 2ddac2e1d..5be716309 100644
--- a/src/video_core/host_shaders/astc_decoder.comp
+++ b/src/video_core/host_shaders/astc_decoder.comp
@@ -339,6 +339,9 @@ uint Select2DPartition(uint seed, uint x, uint y, uint partition_count, bool sma
 }
 
 uint ReadBit() {
+    if (current_index >= local_buff.length()) {
+        return 0;
+    }
     uint bit = bitfieldExtract(local_buff[current_index], bitsread, 1);
     bitsread++;
     total_bitsread++;
@@ -1170,12 +1173,17 @@ void DecompressBlock(ivec3 coord, uint block_index) {
         plane_selector_bits = 2;
     }
     remaining_bits -= plane_selector_bits;
+    if (remaining_bits > 128) {
+        // Bad data, more remaining bits than 4 bytes
+        // return early
+        return;
+    }
     // Read color data...
     uint color_data_bits = remaining_bits;
     while (remaining_bits > 0) {
-        uint nb = min(remaining_bits, 8);
+        int nb = int(min(remaining_bits, 8U));
         uint b = StreamBits(nb);
-        color_endpoint_data[ced_pointer] = uint(bitfieldExtract(b, 0, 8));
+        color_endpoint_data[ced_pointer] = uint(bitfieldExtract(b, 0, nb));
         ced_pointer++;
         remaining_bits -= nb;
     }
-- 
cgit v1.2.3