From 08015f192e27a4305ae24b6c46c3f063e1639c8a Mon Sep 17 00:00:00 2001
From: Stenzek <stenzek@gmail.com>
Date: Wed, 29 Apr 2026 21:26:45 +1000
Subject: [PATCH] CDImagePPF: Fix possible integer underflow in short files

---
 src/util/cd_image_ppf.cpp | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/src/util/cd_image_ppf.cpp b/src/util/cd_image_ppf.cpp
index 1db02e97f..a83ade52f 100644
--- a/src/util/cd_image_ppf.cpp
+++ b/src/util/cd_image_ppf.cpp
@@ -165,7 +165,7 @@ bool CDImagePPF::ReadV1Patch(std::FILE* fp, Error* error)
   }
 
   u32 count = filelen - 56;
-  if (count <= 0)
+  if (count == 0)
   {
     Error::SetStringView(error, "Invalid count/filelen");
     return false;
@@ -261,9 +261,18 @@ bool CDImagePPF::ReadV2Patch(std::FILE* fp, Error* error)
 
   u32 count = filelen - 1084;
   if (idlen > 0)
-    count -= (idlen + 38);
+  {
+    const u32 extralen = idlen + 38;
+    if (count < extralen)
+    {
+      Error::SetStringView(error, "File is too short (diz)");
+      return false;
+    }
+
+    count -= extralen;
+  }
 
-  if (count <= 0)
+  if (count == 0)
     return false;
 
   if (std::fseek(fp, 1084, SEEK_SET) != 0)
@@ -392,8 +401,8 @@ bool CDImagePPF::ReadV3Patch(std::FILE* fp, Error* error)
 
 bool CDImagePPF::AddPatch(u64 offset, std::span<const u8> patch, std::span<const u8> undo_data, Error* error)
 {
-  DEBUG_LOG("Starting applying patch{} of {} bytes at at offset {}", patch.empty() ? "" : " with undo data",
-            patch.size(), offset);
+  DEBUG_LOG("Starting applying patch{} of {} bytes at offset {}", patch.empty() ? "" : " with undo data", patch.size(),
+            offset);
 
   DebugAssert(undo_data.empty() || patch.size() == undo_data.size());