MemoryCard: Sanitize game titles for file names

src/core/memory_card.cpp

@@ -24,6 +24,20 @@ MemoryCard::~MemoryCard()
   SaveIfChanged(false);
 }
 
+std::string MemoryCard::SanitizeGameTitleForFileName(const std::string_view& name)
+{
+  std::string ret(name);
+
+  const u32 len = static_cast<u32>(ret.length());
+  for (u32 i = 0; i < len; i++)
+  {
+    if (ret[i] == '\\' || ret[i] == '/' || ret[i] == '?' || ret[i] == '*')
+      ret[i] = '_';
+  }
+
+  return ret;
+}
+
 TickCount MemoryCard::GetSaveDelayInTicks()
 {
   return System::GetTicksPerSecond() * SAVE_DELAY_IN_SECONDS;

src/core/memory_card.h

@@ -15,6 +15,8 @@ public:
   MemoryCard();
   ~MemoryCard();
 
+  static std::string SanitizeGameTitleForFileName(const std::string_view& name);
+
   static std::unique_ptr<MemoryCard> Create();
   static std::unique_ptr<MemoryCard> Open(std::string_view filename);
 

src/core/system.cpp

@@ -1815,7 +1815,8 @@ void UpdateMemoryCards()
         }
         else
         {
-          card = MemoryCard::Open(g_host_interface->GetGameMemoryCardPath(s_running_game_title.c_str(), i));
+          card = MemoryCard::Open(g_host_interface->GetGameMemoryCardPath(
+            MemoryCard::SanitizeGameTitleForFileName(s_running_game_title).c_str(), i));
         }
       }
       break;

src/duckstation-qt/qthostinterface.cpp

@@ -8,6 +8,7 @@
 #include "core/cheats.h"
 #include "core/controller.h"
 #include "core/gpu.h"
+#include "core/memory_card.h"
 #include "core/system.h"
 #include "frontend-common/fullscreen_ui.h"
 #include "frontend-common/game_list.h"
@@ -1045,7 +1046,8 @@ void QtHostInterface::populateGameListContextMenu(const GameListEntry* entry, QW
           paths[i] = QString::fromStdString(GetGameMemoryCardPath(entry->code.c_str(), i));
           break;
         case MemoryCardType::PerGameTitle:
-          paths[i] = QString::fromStdString(GetGameMemoryCardPath(entry->title.c_str(), i));
+          paths[i] = QString::fromStdString(
+            GetGameMemoryCardPath(MemoryCard::SanitizeGameTitleForFileName(entry->title).c_str(), i));
           break;
         default:
           break;