From f4078ae2670bf98ce0e9e41359a3614ac802946f Mon Sep 17 00:00:00 2001
From: Ac_K <Acoustik666@gmail.com>
Date: Tue, 29 Jun 2021 22:52:17 +0200
Subject: [PATCH] aoc: Fix wrong check (#2427)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR fixes a wrong check added in #2414 which made Pokémon crash.
---
 Ryujinx.HLE/HOS/Services/Ns/Aoc/IAddOnContentManager.cs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/Ryujinx.HLE/HOS/Services/Ns/Aoc/IAddOnContentManager.cs b/Ryujinx.HLE/HOS/Services/Ns/Aoc/IAddOnContentManager.cs
index bdffbbc74b..04a7a4836e 100644
--- a/Ryujinx.HLE/HOS/Services/Ns/Aoc/IAddOnContentManager.cs
+++ b/Ryujinx.HLE/HOS/Services/Ns/Aoc/IAddOnContentManager.cs
@@ -190,13 +190,14 @@ namespace Ryujinx.HLE.HOS.Services.Ns.Aoc
             //       If QuestFlag is true, counts some extra titles.
 
             uint  startIndex     = context.RequestData.ReadUInt32();
-            uint  bufferSize     = context.RequestData.ReadUInt32();
+            uint  counter        = context.RequestData.ReadUInt32();
             ulong bufferPosition = context.Request.ReceiveBuff[0].Position;
+            ulong bufferSize     = context.Request.ReceiveBuff[0].Size;
 
             // TODO: This should use _addOnContentBaseId;
             uint aocCount = (uint)context.Device.System.ContentManager.GetAocCount();
 
-            if (aocCount - startIndex > bufferSize)
+            if (counter > bufferSize / sizeof(uint))
             {
                 return ResultCode.InvalidBufferSize;
             }
@@ -212,7 +213,7 @@ namespace Ryujinx.HLE.HOS.Services.Ns.Aoc
 
             GetAddOnContentBaseIdFromTitleId(context, titleId);
 
-            for (int i = 0; i < aocCount; i++)
+            for (int i = 0; i < aocCount - startIndex; i++)
             {
                 context.Memory.Write(bufferPosition + (ulong)i * 4, (uint)(aocTitleIds[i + (int)startIndex] - _addOnContentBaseId));
             }