From ea2070c139330dd0f3b2c785556c9c647e729149 Mon Sep 17 00:00:00 2001 From: peterferrie Date: Mon, 27 Oct 2014 23:33:41 -0700 Subject: rcdino4: fix OOB access --- src/mame/drivers/funworld.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/mame/drivers/funworld.c b/src/mame/drivers/funworld.c index 569fcfe1d22..f27c3e12cfb 100644 --- a/src/mame/drivers/funworld.c +++ b/src/mame/drivers/funworld.c @@ -6352,8 +6352,9 @@ DRIVER_INIT_MEMBER(funworld_state, rcdino4) } j = 1; + i = 0x81; - for (i = 0x81; i < (0x81 + ARRAY_LENGTH(rcdino4_keys80));) + do { UINT8 key; @@ -6418,9 +6419,14 @@ DRIVER_INIT_MEMBER(funworld_state, rcdino4) while (j < 0x100); j &= 0xff; - do { - assert((i+1 - 0x81) >= 0 && (i+1 - 0x81) < ARRAY_LENGTH(rcdino4_keys80)); - } while (!rcdino4_keys80[++i - 0x81]); + + do {} while (((++i - 0x81) < ARRAY_LENGTH(rcdino4_keys80)) + && !rcdino4_keys80[i - 0x81]); + + if ((i - 0x81) == ARRAY_LENGTH(rcdino4_keys80)) + { + break; + } if ((i == 0xa4) || (i == 0xb0) @@ -6430,6 +6436,7 @@ DRIVER_INIT_MEMBER(funworld_state, rcdino4) j = 0; /* re-align offset after skipping some pages */ } } + while (1); } DRIVER_INIT_MEMBER(funworld_state, rcdinch) -- cgit v1.2.3