summaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
author yz70s <yz70s@users.noreply.github.com>2021-08-14 18:35:42 +0200
committer yz70s <yz70s@users.noreply.github.com>2021-08-15 18:57:07 +0200
commit855c9d4087f2aee9999482ff01b2f99fcade1405 (patch)
tree4d257f45100fb87513ea6bcf0a14dea81004d98e
parent57ddc51b52f53cc33bfe810beb5f38dabf73ab85 (diff)
divtlb.cpp: remove a crash caused by the modulus operator
In the original code all values are signed integers, so m_dynindex would overflow and become negative, then the modulus of a negative value by a positive one would generate a negative result and finally the next array read would make the program crash. Also the maximum value plus one of m_dynindex is not generally a multiple of m_dynamic and this would cause a jump in the values of liveindex.
-rw-r--r--src/emu/divtlb.cpp8
1 files changed, 6 insertions, 2 deletions
diff --git a/src/emu/divtlb.cpp b/src/emu/divtlb.cpp
index a09abd5300a..41a0aa96aad 100644
--- a/src/emu/divtlb.cpp
+++ b/src/emu/divtlb.cpp
@@ -177,8 +177,9 @@ bool device_vtlb_interface::vtlb_fill(offs_t address, int intention)
// if this is the first successful translation for this address, allocate a new entry
if ((entry & VTLB_FLAGS_MASK) == 0)
{
- int liveindex = m_dynindex++ % m_dynamic;
+ int liveindex = m_dynindex;
+ m_dynindex = (m_dynindex + 1) % m_dynamic;
// if an entry already exists at this index, free it
if (m_live[liveindex] != 0)
@@ -277,7 +278,10 @@ void device_vtlb_interface::vtlb_dynload(u32 index, offs_t address, vtlb_entry v
return;
}
- int liveindex = m_dynindex++ % m_dynamic;
+ int liveindex = m_dynindex;
+
+ m_dynindex = (m_dynindex + 1) % m_dynamic;
+
// is entry already live?
if (!(entry & VTLB_FLAG_VALID))
{