3 files changed, 29 insertions, 11 deletions

diff --git a/src/core/hle/service/time/time_zone_content_manager.cpp b/src/core/hle/service/time/time_zone_content_manager.cpp
index 5d60be67a..3b6047ad0 100644
--- a/src/core/hle/service/time/time_zone_content_manager.cpp
+++ b/src/core/hle/service/time/time_zone_content_manager.cpp
@@ -3,6 +3,7 @@
 
 #include <chrono>
 #include <sstream>
+#include <utility>
 
 #include "common/logging/log.h"
 #include "common/settings.h"
@@ -46,14 +47,14 @@ static FileSys::VirtualDir GetTimeZoneBinary(Core::System& system) {
     return FileSys::ExtractRomFS(romfs);
 }
 
-static std::vector<std::string> BuildLocationNameCache(Core::System& system) {
-    const FileSys::VirtualDir extracted_romfs{GetTimeZoneBinary(system)};
-    if (!extracted_romfs) {
+static std::vector<std::string> BuildLocationNameCache(
+    const FileSys::VirtualDir& time_zone_binary) {
+    if (!time_zone_binary) {
         LOG_ERROR(Service_Time, "Failed to extract RomFS for {:016X}!", time_zone_binary_titleid);
         return {};
     }
 
-    const FileSys::VirtualFile binary_list{extracted_romfs->GetFile("binaryList.txt")};
+    const FileSys::VirtualFile binary_list{time_zone_binary->GetFile("binaryList.txt")};
     if (!binary_list) {
         LOG_ERROR(Service_Time, "{:016X} has no file binaryList.txt!", time_zone_binary_titleid);
         return {};
@@ -73,7 +74,8 @@ static std::vector<std::string> BuildLocationNameCache(Core::System& system) {
 }
 
 TimeZoneContentManager::TimeZoneContentManager(Core::System& system_)
-    : system{system_}, location_name_cache{BuildLocationNameCache(system)} {}
+    : system{system_}, time_zone_binary{GetTimeZoneBinary(system)},
+      location_name_cache{BuildLocationNameCache(time_zone_binary)} {}
 
 void TimeZoneContentManager::Initialize(TimeManager& time_manager) {
     const auto timezone_setting = Settings::GetTimeZoneString();
@@ -111,13 +113,12 @@ Result TimeZoneContentManager::GetTimeZoneInfoFile(const std::string& location_n
         return ERROR_TIME_NOT_FOUND;
     }
 
-    const FileSys::VirtualDir extracted_romfs{GetTimeZoneBinary(system)};
-    if (!extracted_romfs) {
+    if (!time_zone_binary) {
         LOG_ERROR(Service_Time, "Failed to extract RomFS for {:016X}!", time_zone_binary_titleid);
         return ERROR_TIME_NOT_FOUND;
     }
 
-    const FileSys::VirtualDir zoneinfo_dir{extracted_romfs->GetSubdirectory("zoneinfo")};
+    const FileSys::VirtualDir zoneinfo_dir{time_zone_binary->GetSubdirectory("zoneinfo")};
     if (!zoneinfo_dir) {
         LOG_ERROR(Service_Time, "{:016X} has no directory zoneinfo!", time_zone_binary_titleid);
         return ERROR_TIME_NOT_FOUND;
diff --git a/src/core/hle/service/time/time_zone_content_manager.h b/src/core/hle/service/time/time_zone_content_manager.h
index 3d94b6428..a6f9698bc 100644
--- a/src/core/hle/service/time/time_zone_content_manager.h
+++ b/src/core/hle/service/time/time_zone_content_manager.h
@@ -6,6 +6,7 @@
 #include <string>
 #include <vector>
 
+#include "core/file_sys/vfs_types.h"
 #include "core/hle/service/time/time_zone_manager.h"
 
 namespace Core {
@@ -41,6 +42,7 @@ private:
 
     Core::System& system;
     TimeZoneManager time_zone_manager;
+    const FileSys::VirtualDir time_zone_binary;
     const std::vector<std::string> location_name_cache;
 };
 
diff --git a/src/core/memory.cpp b/src/core/memory.cpp
index 513bc4edb..fa5273402 100644
--- a/src/core/memory.cpp
+++ b/src/core/memory.cpp
@@ -24,6 +24,16 @@
 
 namespace Core::Memory {
 
+namespace {
+
+bool AddressSpaceContains(const Common::PageTable& table, const Common::ProcessAddress addr,
+                          const std::size_t size) {
+    const Common::ProcessAddress max_addr = 1ULL << table.GetAddressSpaceBits();
+    return addr + size >= addr && addr + size <= max_addr;
+}
+
+} // namespace
+
 // Implementation class used to keep the specifics of the memory subsystem hidden
 // from outside classes. This also allows modification to the internals of the memory
 // subsystem without needing to rebuild all files that make use of the memory interface.
@@ -191,6 +201,11 @@ struct Memory::Impl {
         std::size_t page_offset = addr & YUZU_PAGEMASK;
         bool user_accessible = true;
 
+        if (!AddressSpaceContains(page_table, addr, size)) [[unlikely]] {
+            on_unmapped(size, addr);
+            return false;
+        }
+
         while (remaining_size) {
             const std::size_t copy_amount =
                 std::min(static_cast<std::size_t>(YUZU_PAGESIZE) - page_offset, remaining_size);
@@ -421,7 +436,7 @@ struct Memory::Impl {
     }
 
     void MarkRegionDebug(u64 vaddr, u64 size, bool debug) {
-        if (vaddr == 0) {
+        if (vaddr == 0 || !AddressSpaceContains(*current_page_table, vaddr, size)) {
             return;
         }
 
@@ -478,7 +493,7 @@ struct Memory::Impl {
     }
 
     void RasterizerMarkRegionCached(u64 vaddr, u64 size, bool cached) {
-        if (vaddr == 0) {
+        if (vaddr == 0 || !AddressSpaceContains(*current_page_table, vaddr, size)) {
             return;
         }
 
@@ -615,7 +630,7 @@ struct Memory::Impl {
         // AARCH64 masks the upper 16 bit of all memory accesses
         vaddr = vaddr & 0xffffffffffffULL;
 
-        if (vaddr >= 1uLL << current_page_table->GetAddressSpaceBits()) {
+        if (!AddressSpaceContains(*current_page_table, vaddr, 1)) [[unlikely]] {
             on_unmapped();
             return nullptr;
         }