From 855c9d4087f2aee9999482ff01b2f99fcade1405 Mon Sep 17 00:00:00 2001 From: yz70s Date: Sat, 14 Aug 2021 18:35:42 +0200 Subject: divtlb.cpp: remove a crash caused by the modulus operator In the original code all values are signed integers, so m_dynindex would overflow and become negative, then the modulus of a negative value by a positive one would generate a negative result and finally the next array read would make the program crash. Also the maximum value plus one of m_dynindex is not generally a multiple of m_dynamic and this would cause a jump in the values of liveindex. --- src/emu/divtlb.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/emu/divtlb.cpp b/src/emu/divtlb.cpp index a09abd5300a..41a0aa96aad 100644 --- a/src/emu/divtlb.cpp +++ b/src/emu/divtlb.cpp @@ -177,8 +177,9 @@ bool device_vtlb_interface::vtlb_fill(offs_t address, int intention) // if this is the first successful translation for this address, allocate a new entry if ((entry & VTLB_FLAGS_MASK) == 0) { - int liveindex = m_dynindex++ % m_dynamic; + int liveindex = m_dynindex; + m_dynindex = (m_dynindex + 1) % m_dynamic; // if an entry already exists at this index, free it if (m_live[liveindex] != 0) @@ -277,7 +278,10 @@ void device_vtlb_interface::vtlb_dynload(u32 index, offs_t address, vtlb_entry v return; } - int liveindex = m_dynindex++ % m_dynamic; + int liveindex = m_dynindex; + + m_dynindex = (m_dynindex + 1) % m_dynamic; + // is entry already live? if (!(entry & VTLB_FLAG_VALID)) { -- cgit v1.2.3