diff options
author | 2021-08-14 18:35:42 +0200 | |
---|---|---|
committer | 2021-08-15 18:57:07 +0200 | |
commit | 855c9d4087f2aee9999482ff01b2f99fcade1405 (patch) | |
tree | 4d257f45100fb87513ea6bcf0a14dea81004d98e | |
parent | 57ddc51b52f53cc33bfe810beb5f38dabf73ab85 (diff) |
divtlb.cpp: remove a crash caused by the modulus operator
In the original code all values are signed integers, so m_dynindex would
overflow and become negative, then the modulus of a negative value by a
positive one would generate a negative result and finally the next array
read would make the program crash.
Also the maximum value plus one of m_dynindex is not generally a
multiple of m_dynamic and this would cause a jump in the values of
liveindex.
-rw-r--r-- | src/emu/divtlb.cpp | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/emu/divtlb.cpp b/src/emu/divtlb.cpp index a09abd5300a..41a0aa96aad 100644 --- a/src/emu/divtlb.cpp +++ b/src/emu/divtlb.cpp @@ -177,8 +177,9 @@ bool device_vtlb_interface::vtlb_fill(offs_t address, int intention) // if this is the first successful translation for this address, allocate a new entry if ((entry & VTLB_FLAGS_MASK) == 0) { - int liveindex = m_dynindex++ % m_dynamic; + int liveindex = m_dynindex; + m_dynindex = (m_dynindex + 1) % m_dynamic; // if an entry already exists at this index, free it if (m_live[liveindex] != 0) @@ -277,7 +278,10 @@ void device_vtlb_interface::vtlb_dynload(u32 index, offs_t address, vtlb_entry v return; } - int liveindex = m_dynindex++ % m_dynamic; + int liveindex = m_dynindex; + + m_dynindex = (m_dynindex + 1) % m_dynamic; + // is entry already live? if (!(entry & VTLB_FLAG_VALID)) { |