`unpack-pbp`: unvalidated PBP offsets → silent file clobbering and attacker-sized write; `psp-prxgen`: unbounded `strcpy` of section name

Start with tools/unpack-pbp.c and tools/psp-prxgen.c, then inspect the header and section definitions in tools/elftypes.h. Check how the tools read PBP offsets and ELF section names, and add validation for malformed input as described in the issue. Done means invalid offsets and overlong or unterminated section names are rejected safely; verify with the supplied reproductions or create equivalent malformed inputs.

unpack-pbp: unvalidated offsets → attacker-sized output write (up to ~2 GiB per section); psp-prxgen: unbounded strcpy of section name

Two separate input-validation bugs in tools/. I'm reporting them privately rather than
posting full exploit detail: this repo has no SECURITY.md and "Private vulnerability
reporting" is disabled. Could you either enable it or tell me a preferred contact?

Both tools consume untrusted third-party artifacts (PBP / ELF), so the impact lands in
whatever developer machine or packaging pipeline processes such a file.

1. tools/unpack-pbp.c — header offsets are never validated (CWE-400 / CWE-1284)

if (loop0 == 7) size = total_size - header.offset[loop0];        /* :131 */
else            size = header.offset[loop0 + 1] - header.offset[loop0];  /* :133 */
if (!size) continue;                                             /* :140 */
...
readsize = size;                                                 /* :169 */
fread(buffer, readsize, 1, infile);                              /* :174 */
fwrite(buffer, readsize, 1, outfile);                            /* :182 */
} while (size);                                                  /* :189 */

The eight offsets come straight from the file and are never checked for monotonicity or
against the real file size; if (!size) is the only length gate, and it rejects exactly
zero. Two consequences, both reproduced by compiling the file as-is in a sandbox:

• Attacker-sized output write. A 140-byte PBP with offset[7] = 0x7FFFFFF0 makes the
  tool write a DATA.PSP with no relation to the input size: the loop runs
  ceil(size / 16 MiB) times, so the section tops out at ~2 GiB and the tool then exits
  0. fread returns 0 at EOF, but the return value is only tested as result < 0 on a
  size_t — always false — so short reads go unnoticed and the stale 16 MB buffer keeps
  being written out (the tail of the file is unrelated heap content).
• Negative length. offset[i+1] < offset[i] gives a negative size; on glibc the
  fread call then fails with EOVERFLOW and the tool silently writes a 0-byte file.
  No memory corruption there — I want to be precise about that, since it's the kind of
  thing that gets miscategorised.

Net effect: attacker-controlled disk consumption (~2 GiB per crafted section, and eight
sections are unpacked in one run) and silent clobbering of files in the working directory,
from a 140-byte input. Not a memory-safety bug, but it is a real
availability/integrity issue for anything that auto-processes PBPs.

2. tools/psp-prxgen.c — unbounded strcpy of the section name (CWE-121)

strcpy(g_elfsections[i].szName,
       (char *)(g_elfsections[g_elfhead.iShstrndx].pData + g_elfsections[i].iName));  /* :303 */

szName is char[ELF_SECT_MAX_NAME] = char[128] (tools/elftypes.h:20,49); the source
is the shstrtab string at the attacker-controlled sh_name offset, with no length check
and no guarantee of NUL-termination inside the table.

Reproduced: a hand-built 384-byte ELF whose section name is 200 bytes, compiled with
-D_FORTIFY_SOURCE=2, aborts with *** buffer overflow detected *** at :303; the same
file with a 100-byte name runs to the normal "no sceModuleInfo section found" path. Under
ASan the 200-byte name corrupts the adjacent ElfSection entries and faults inside
load_sections. 120 bytes of overflow into a global array — worth fixing regardless of
how the tool is invoked.

Fix for both: validate the PBP offset table right after the signature check
(non-decreasing, >= sizeof(HEADER), <= total_size, and reject short fread), and
bound the section-name copy to ELF_SECT_MAX_NAME - 1 while rejecting over-long names.

Happy to send the two input files and the build commands, and to open a PR against a
branch of your choosing.

Regards,
贵志的猫