The final room check ran even when dst was null, so a size query such as
(nullptr, 0, src, n, &length) returned NP_UTIL_ERROR_BUFFER_TOO_SMALL and never
wrote the required length, although the per-character checks in the same
function already skip the comparison for a null destination. The check now
applies only when there is a destination.
After a high surrogate, sceNpUtilJsonGetOneChar parsed four hex digits at offset
8 without checking that offsets 6 and 7 hold a backslash and a 'u'. The string
"\ud83dXXde00" decoded to U+1F600 and consumed 12 bytes, swallowing the two
unrelated characters. sceNpUtilJsonUnescape already makes that check. A high
surrogate not followed by \u now takes the same failure path as an invalid low
surrogate.
sceNpUtilJsonEscape appends to the destination with strcat, but the room check
started its running length at 0 and ignored the text the buffer already held,
so escaping into a partly filled buffer wrote past its end:
sceNpUtilJsonEscape(buf, 16, "\n\n\n", 3) on a buffer holding ten characters
placed 16 characters and the terminator in 16 bytes.
The running length now starts at the length of the existing text, and a
destination that is already full returns NP_UTIL_ERROR_BUFFER_TOO_SMALL.
Builds on #9037. Adds threads, event flags, semaphores, atomics, heaps
and kernel memory, callout contexts, time and SDK version queries,
base64 and hex codecs, integer and string helpers, JSON escaping, URL
encoding, online id strings, language codes, title ids and debug output.
The behaviour follows libSceNpCommon.sprx from firmware 12.00, read
from disassembly.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
MarcZX10