From 907d92bf8cfad334cb1b83755f48b6bfea391806 Mon Sep 17 00:00:00 2001
From: Adrian <78108584+AdrianCassar@users.noreply.github.com>
Date: Wed, 13 May 2026 12:48:16 +0100
Subject: [PATCH] [XAM] Fixed potential OOB memory write in copy utils

---
 src/xenia/kernel/xam/profile_manager.cc | 2 +-
 src/xenia/kernel/xam/xam_info.cc        | 3 ++-
 src/xenia/kernel/xam/xam_locale.cc      | 6 ++++--
 src/xenia/kernel/xam/xam_ui.cc          | 2 +-
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/xenia/kernel/xam/profile_manager.cc b/src/xenia/kernel/xam/profile_manager.cc
index 33bb26479..bf31c1438 100644
--- a/src/xenia/kernel/xam/profile_manager.cc
+++ b/src/xenia/kernel/xam/profile_manager.cc
@@ -499,7 +499,7 @@ bool ProfileManager::CreateAccount(const uint64_t xuid,
   const std::u16string gamertag_u16 = xe::to_utf16(gamertag);
 
   string_util::copy_and_swap_truncating(account.gamertag, gamertag_u16,
-                                        sizeof(account.gamertag));
+                                        xe::countof(account.gamertag));
 
   const bool result = UpdateAccount(xuid, &account);
   DismountProfile(xuid);
diff --git a/src/xenia/kernel/xam/xam_info.cc b/src/xenia/kernel/xam/xam_info.cc
index 8cfba3075..be7a31a7a 100644
--- a/src/xenia/kernel/xam/xam_info.cc
+++ b/src/xenia/kernel/xam/xam_info.cc
@@ -204,8 +204,9 @@ dword_result_t keXamBuildResourceLocator(uint64_t module,
     path = fmt::format(u"section://{:X},{}#{}", (uint32_t)module, container,
                        resource);
   }
+  const uint32_t char_count = buffer_count / sizeof(char16_t);
   xe::string_util::copy_and_swap_truncating(buffer_ptr.as<char16_t*>(), path,
-                                            buffer_count);
+                                            char_count);
   return 0;
 }
 
diff --git a/src/xenia/kernel/xam/xam_locale.cc b/src/xenia/kernel/xam/xam_locale.cc
index 598bd6798..0c8f4e451 100644
--- a/src/xenia/kernel/xam/xam_locale.cc
+++ b/src/xenia/kernel/xam/xam_locale.cc
@@ -496,7 +496,8 @@ void XFormatDateString(uint64_t filetime, uint32_t buffer_address,
                          static_cast<unsigned>(year_month_day.month()),
                          static_cast<unsigned>(year_month_day.day()),
                          static_cast<int>(year_month_day.year()));
-  xe::string_util::copy_and_swap_truncating(buffer, str, buffer_size);
+  const uint32_t char_count = buffer_size / sizeof(char16_t);
+  xe::string_util::copy_and_swap_truncating(buffer, str, char_count);
 }
 
 void XamFormatDateString_entry(dword_t locale_format, qword_t filetime,
@@ -523,7 +524,8 @@ void XFormatTimeString(uint64_t filetime, uint32_t buffer_address,
 
   auto str = fmt::format(u"{:02d}:{:02d}", time.hours().count(),
                          time.minutes().count());
-  xe::string_util::copy_and_swap_truncating(buffer, str, buffer_size);
+  const uint32_t char_count = buffer_size / sizeof(char16_t);
+  xe::string_util::copy_and_swap_truncating(buffer, str, char_count);
 }
 
 void XamFormatTimeString_entry(dword_t user_index, qword_t filetime,
diff --git a/src/xenia/kernel/xam/xam_ui.cc b/src/xenia/kernel/xam/xam_ui.cc
index 58dbb34e6..e92d44174 100644
--- a/src/xenia/kernel/xam/xam_ui.cc
+++ b/src/xenia/kernel/xam/xam_ui.cc
@@ -474,7 +474,7 @@ dword_result_t XamShowKeyboardUI_entry(
 
   assert_not_null(overlapped);
 
-  auto buffer_size = static_cast<size_t>(buffer_length) * 2;
+  auto buffer_size = static_cast<size_t>(buffer_length) * sizeof(char16_t);
 
   X_RESULT result;
   if (cvars::headless) {