Validate SELF metadata header sizes

Author: acts-1631

rpcs3/Crypto/unself.cpp

@@ -627,7 +627,17 @@ bool SCEDecrypter::LoadMetadata(const u8 erk[32], const u8 riv[16])
 {
 	aes_context aes;
 	std::vector<u8> metadata_info(sizeof(meta_info));
-	std::vector<u8> metadata_headers(sce_hdr.se_hsize - (sizeof(sce_hdr) + sce_hdr.se_meta + sizeof(meta_info)));
+	const u64 metadata_headers_offset = sizeof(sce_hdr) + sce_hdr.se_meta + sizeof(meta_info);
+
+	if (sce_hdr.se_hsize < metadata_headers_offset ||
+		sce_hdr.se_hsize - metadata_headers_offset < sizeof(meta_hdr) ||
+		sce_hdr.se_hsize > sce_f.size())
+	{
+		self_log.error("Invalid SCE metadata header size!");
+		return false;
+	}
+
+	std::vector<u8> metadata_headers(sce_hdr.se_hsize - metadata_headers_offset);
 
 	// Locate and read the encrypted metadata info.
 	sce_f.seek(sce_hdr.se_meta + sizeof(sce_hdr));
@@ -1123,7 +1133,17 @@ bool SELFDecrypter::LoadMetadata(const u8* klic_key)
 {
 	aes_context aes;
 	std::vector<u8> metadata_info(sizeof(meta_info));
-	std::vector<u8> metadata_headers(sce_hdr.se_hsize - (sizeof(sce_hdr) + sce_hdr.se_meta + sizeof(meta_info)));
+	const u64 metadata_headers_offset = sizeof(sce_hdr) + sce_hdr.se_meta + sizeof(meta_info);
+
+	if (sce_hdr.se_hsize < metadata_headers_offset ||
+		sce_hdr.se_hsize - metadata_headers_offset < sizeof(meta_hdr) ||
+		sce_hdr.se_hsize > self_f.size())
+	{
+		self_log.error("Invalid SELF metadata header size!");
+		return false;
+	}
+
+	std::vector<u8> metadata_headers(sce_hdr.se_hsize - metadata_headers_offset);
 
 	// Locate and read the encrypted metadata info.
 	self_f.seek(sce_hdr.se_meta + sizeof(sce_hdr));