CSeverity: MediumStatus: Published

CEmu: integer overflow in the cert_field_get length check allows an out-of-bounds read on a crafted ROM

cert_field_get in core/cert.c checked a certificate field’s length with an addition that could overflow a 32-bit integer. With a very large field length, the sum wrapped around, the bounds check passed, and callers read far past the end of the ROM buffer. Loading a crafted TI calculator ROM could therefore cause an out-of-bounds read and crash the emulator (SEGV). The attack is local and needs the user to load the ROM.