From 946a7f4d5eda16a92a3bb2a8148ecc0ed6848ede Mon Sep 17 00:00:00 2001 From: hap Date: Mon, 15 Jun 2020 21:55:09 +0200 Subject: dbox: fix crash, array out of bounds access (nw) --- src/devices/machine/intelfsh.cpp | 2 +- src/mame/drivers/dbox.cpp | 12 +++++++----- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/src/devices/machine/intelfsh.cpp b/src/devices/machine/intelfsh.cpp index dd9aa956287..77281819bdf 100644 --- a/src/devices/machine/intelfsh.cpp +++ b/src/devices/machine/intelfsh.cpp @@ -87,7 +87,7 @@ DEFINE_DEVICE_TYPE(AMD_29F040, amd_29f040_device, "amd_29f DEFINE_DEVICE_TYPE(AMD_29F080, amd_29f080_device, "amd_29f080", "AMD 29F080 Flash") DEFINE_DEVICE_TYPE(AMD_29F400T, amd_29f400t_device, "amd_29f400t", "AMD 29F400T Flash") DEFINE_DEVICE_TYPE(AMD_29F800T, amd_29f800t_device, "amd_29f800t", "AMD 29F800T Flash") -DEFINE_DEVICE_TYPE(AMD_29F800B_16BIT, amd_29f800b_16bit_device, "amd_29f800b_16bit", "AMD 29F800B Flash used in 16 bit mode") +DEFINE_DEVICE_TYPE(AMD_29F800B_16BIT, amd_29f800b_16bit_device, "amd_29f800b_16bit", "AMD 29F800B Flash (16-bit)") DEFINE_DEVICE_TYPE(AMD_29LV200T, amd_29lv200t_device, "amd_29lv200t", "AMD 29LV200T Flash") DEFINE_DEVICE_TYPE(FUJITSU_29F160TE, fujitsu_29f160te_device, "mbm29f160te", "Fujitsu MBM29F160TE Flash") DEFINE_DEVICE_TYPE(FUJITSU_29F016A, fujitsu_29f016a_device, "mbm29f016a", "Fujitsu MBM29F016A Flash") diff --git a/src/mame/drivers/dbox.cpp b/src/mame/drivers/dbox.cpp index 5249a8647b8..fd2b905e5a9 100644 --- a/src/mame/drivers/dbox.cpp +++ b/src/mame/drivers/dbox.cpp @@ -479,7 +479,7 @@ void dbox_state::machine_start() #if LOCALFLASH save_pointer (NAME (m_sysflash), sizeof(m_sysflash)); - m_sysflash = (uint16_t*)(memregion ("flash")->base()); + m_sysflash = (uint16_t*)(memregion ("flash0")->base()); m_sf_mode = 0; m_sf_state = 0; #endif @@ -580,10 +580,11 @@ void dbox_state::dbox_map(address_map &map) // 008004ee Address mask CS0 00000040, 003ffff5 (ffffffff) - Mask: 003fff00 FCM:0f DD:1 PS: 16-Bit // 008004f8 Base address CS0 00000044, 0000005b (ffffffff) - Base: 00000000 BFC:05 WP:1 FTE:0 NCS:1 Valid: Yes #if LOCALFLASH - map(0x000000, 0x3fffff).rom().r(FUNC(dbox_state::sysflash_r)).region("flash", 0); + map(0x000000, 0x3fffff).rom().r(FUNC(dbox_state::sysflash_r)).region("flash0", 0); map(0x000000, 0x3fffff).w(FUNC(dbox_state::sysflash_w)); #else - map(0x000000, 0x3fffff).rw("flash", FUNC(intelfsh16_device::read), FUNC(intelfsh16_device::write)); + map(0x000000, 0x0fffff).rw("flash0", FUNC(intelfsh16_device::read), FUNC(intelfsh16_device::write)); + map(0x100000, 0x1fffff).rw("flash1", FUNC(intelfsh16_device::read), FUNC(intelfsh16_device::write)); #endif // CS2 - CS demux // 0000009a Address mask CS2 00000050, 00007fff (ffffffff) - Mask: 00007f00 FCM:0f DD:3 PS: External DSACK response @@ -625,7 +626,8 @@ void dbox_state::dbox(machine_config &config) modem.rxd_handler().set("maincpu:serial", FUNC(mc68340_serial_module_device::rx_b_w)); /* Add the boot flash */ - AMD_29F800B_16BIT(config, "flash"); + AMD_29F800B_16BIT(config, "flash0"); + AMD_29F800B_16BIT(config, "flash1"); /* LED Matrix Display */ SDA5708(config, m_display, 0); @@ -643,7 +645,7 @@ void dbox_state::init_dbox() // TODO: Figure out correct ROM address map // TODO: Figure out what DVB2000 is doing ROM_START( dbox ) - ROM_REGION16_BE(0x400000, "flash", ROMREGION_ERASEFF) + ROM_REGION16_BE(0x400000, "flash0", ROMREGION_ERASEFF) // should be 0x100000 ROM_DEFAULT_BIOS("b200uns") ROM_SYSTEM_BIOS(0, "b200uns", "Nokia Bootloader B200uns") -- cgit v1.2.3