summaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
author Angelo Salese <angelosa@users.noreply.github.com>2013-09-15 23:49:35 +0000
committer Angelo Salese <angelosa@users.noreply.github.com>2013-09-15 23:49:35 +0000
commit162959b04f60fe45d3a5126c6b48571b2d1fac9a (patch)
treeba7d5b6e76766867de1c7698ea8513ed92e83c99
parenta5d4726978018a1e6ae54ea1fbea287138c00cb7 (diff)
Fixed fb out-of-bounds writes
-rw-r--r--src/mame/video/powervr2.c95
-rw-r--r--src/mess/drivers/dccons.c2
2 files changed, 67 insertions, 30 deletions
diff --git a/src/mame/video/powervr2.c b/src/mame/video/powervr2.c
index 7db013801b5..f0ca955e6fe 100644
--- a/src/mame/video/powervr2.c
+++ b/src/mame/video/powervr2.c
@@ -2996,11 +2996,12 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
UINT32 *fbaddr;
UINT32 c;
UINT32 r,g,b;
- //INT32 vo_horz_start_pos = vo_startx & 0x3ff;
UINT8 interlace_on = ((spg_control & 0x10) >> 4);
INT32 ystart_f1 = (vo_starty & 0x3ff) << interlace_on;
//INT32 ystart_f2 = (vo_starty >> 16) & 0x3ff;
INT32 hstart = (vo_startx & 0x3ff);
+ int res_x,res_y;
+// rectangle fbclip;
UINT8 unpackmode = (fb_r_ctrl & 0x0000000c) >>2; // aka fb_depth
UINT8 enable = (fb_r_ctrl & 0x00000001);
@@ -3017,6 +3018,15 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
// popmessage("%d %d %d %d %d",ystart_f1,ystart_f2,interlace_on,spg_vblank & 0x3ff,(spg_vblank >> 16) & 0x3ff);
+#if 0
+ fbclip.min_x = hstart;
+ fbclip.min_y = ystart_f1;
+ fbclip.max_x = hstart + (xi << ((vo_control & 0x100) >> 8));
+ fbclip.max_y = ystart_f1 + dy;
+
+ popmessage("%d %d %d %d",fbclip.min_x,fbclip.min_y,fbclip.max_x,fbclip.max_y);
+#endif
+
switch (unpackmode)
{
case 0x00: // 0555 RGB 16-bit, Cleo Fortune Plus
@@ -3028,18 +3038,23 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
{
for (x=0;x < xi;x++)
{
- fbaddr=&bitmap.pix32(y + ystart_f1, x*2+0 + hstart);
+ res_x = x*2+0 + hstart;
+ res_y = y + ystart_f1;
+
+ fbaddr=&bitmap.pix32(res_y, res_x);
c=*((reinterpret_cast<UINT16 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 1));
b = (c & 0x001f) << 3;
g = (c & 0x03e0) >> 2;
r = (c & 0x7c00) >> 7;
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
- fbaddr=&bitmap.pix32(y + ystart_f1, x*2+1 + hstart);
- if (y<=cliprect.max_y)
+ res_x = x*2+1 + hstart;
+
+ fbaddr=&bitmap.pix32(res_y, res_x);
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
addrp+=2;
}
@@ -3048,14 +3063,17 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
{
for (x=0;x < xi;x++)
{
- fbaddr=&bitmap.pix32(y + ystart_f1, x + hstart);
+ res_x = x + hstart;
+ res_y = y + ystart_f1;
+
+ fbaddr=&bitmap.pix32(res_y, res_x);
c=*((reinterpret_cast<UINT16 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 1));
b = (c & 0x001f) << 3;
g = (c & 0x03e0) >> 2;
r = (c & 0x7c00) >> 7;
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
addrp+=2;
}
@@ -3072,19 +3090,23 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
{
for (x=0;x < xi;x++)
{
- fbaddr=&bitmap.pix32(y + ystart_f1, x*2+0 + hstart);
+ res_x = x*2+0 + hstart;
+ res_y = y + ystart_f1;
+ fbaddr=&bitmap.pix32(res_y, res_x);
c=*((reinterpret_cast<UINT16 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 1));
b = (c & 0x001f) << 3;
g = (c & 0x07e0) >> 3;
r = (c & 0xf800) >> 8;
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
- fbaddr=&bitmap.pix32(y + ystart_f1, x*2+1 + hstart);
+ res_x = x*2+1 + hstart;
+ //res_y = y + ystart_f1;
+ fbaddr=&bitmap.pix32(res_y, res_x);
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
addrp+=2;
@@ -3094,14 +3116,16 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
{
for (x=0;x < xi;x++)
{
- fbaddr=&bitmap.pix32(y + ystart_f1, x + hstart);
+ res_x = x + hstart;
+ res_y = y + ystart_f1;
+ fbaddr=&bitmap.pix32(res_y, res_x);
c=*((reinterpret_cast<UINT16 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 1));
b = (c & 0x001f) << 3;
g = (c & 0x07e0) >> 3;
r = (c & 0xf800) >> 8;
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
addrp+=2;
}
@@ -3118,7 +3142,10 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
{
for (x=0;x < xi;x++)
{
- fbaddr=&bitmap.pix32(y + ystart_f1, x*2+0 + hstart);
+ res_x = x*2+0 + hstart;
+ res_y = y + ystart_f1;
+
+ fbaddr=&bitmap.pix32(res_y, res_x);
c =*(UINT8 *)((reinterpret_cast<UINT8 *>(dc_framebuffer_ram)) + BYTE8_XOR_LE(addrp));
b = c;
@@ -3129,11 +3156,13 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
c =*(UINT8 *)((reinterpret_cast<UINT8 *>(dc_framebuffer_ram)) + BYTE8_XOR_LE(addrp+2));
r = c;
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
- fbaddr=&bitmap.pix32(y + ystart_f1, x*2+1 + hstart);
- if (y<=cliprect.max_y)
+ res_x = x*2+1 + hstart;
+
+ fbaddr=&bitmap.pix32(res_y, res_x);
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
addrp+=3;
@@ -3143,7 +3172,9 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
{
for (x=0;x < xi;x++)
{
- fbaddr=&bitmap.pix32(y + ystart_f1, x + hstart);
+ res_x = x + hstart;
+ res_y = y + ystart_f1;
+ fbaddr=&bitmap.pix32(res_y, res_x);
c =*(UINT8 *)((reinterpret_cast<UINT8 *>(dc_framebuffer_ram)) + BYTE8_XOR_LE(addrp));
b = c;
@@ -3154,7 +3185,7 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
c =*(UINT8 *)((reinterpret_cast<UINT8 *>(dc_framebuffer_ram)) + BYTE8_XOR_LE(addrp+2));
r = c;
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
addrp+=3;
@@ -3172,18 +3203,23 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
{
for (x=0;x < xi;x++)
{
- fbaddr=&bitmap.pix32(y + ystart_f1, x*2+0 + hstart);
+ res_x = x*2+0 + hstart;
+ res_y = y + ystart_f1;
+
+ fbaddr=&bitmap.pix32(res_y, res_x);
c =*((reinterpret_cast<UINT32 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 2));
b = (c & 0x0000ff) >> 0;
g = (c & 0x00ff00) >> 8;
r = (c & 0xff0000) >> 16;
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
- fbaddr=&bitmap.pix32(y + ystart_f1, x*2+1 + hstart);
- if (y<=cliprect.max_y)
+ res_x = x*2+1 + hstart;
+
+ fbaddr=&bitmap.pix32(res_y, res_x);
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
addrp+=4;
@@ -3193,14 +3229,16 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle &
{
for (x=0;x < xi;x++)
{
- fbaddr=&bitmap.pix32(y + ystart_f1, x + hstart);
+ res_x = x + hstart;
+ res_y = y + ystart_f1;
+ fbaddr=&bitmap.pix32(res_y, res_x);
c =*((reinterpret_cast<UINT32 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 2));
b = (c & 0x0000ff) >> 0;
g = (c & 0x00ff00) >> 8;
r = (c & 0xff0000) >> 16;
- if (y<=cliprect.max_y)
+ if (cliprect.contains(res_x, res_y))
*fbaddr = b | (g<<8) | (r<<16);
addrp+=4;
@@ -3734,11 +3772,8 @@ void powervr2_device::pvr_scanline_timer(int vpos)
UINT8 interlace_on = ((spg_control & 0x10) >> 4);
dc_state *state = machine().driver_data<dc_state>();
- if(interlace_on)
- {
- vbin_line <<= 1;
- vbout_line <<= 1;
- }
+ vbin_line <<= interlace_on;
+ vbout_line <<= interlace_on;
if(vbin_line-(1+interlace_on) == vpos)
state->m_maple->maple_hw_trigger();
diff --git a/src/mess/drivers/dccons.c b/src/mess/drivers/dccons.c
index f20289c414a..5c13ab30634 100644
--- a/src/mess/drivers/dccons.c
+++ b/src/mess/drivers/dccons.c
@@ -20,6 +20,8 @@
TODO:
- RTC error always pops up at start-up, no flash plus bug with ticks (needs rewrite)
- Inputs doesn't work most of the time;
+ - Candy Stripe: fills the log with "ATAPI_FEATURES_FLAG_OVL not supported", black screen
+ - Carrier: Jaleco logo uses YUV, but y size is halved?
- F355 Challenge: black screen after Sega logo;
- Idol Janshi wo Tsukucchaou: pixel aspect is way wrong (stretched and offsetted horizontally)
- Power Stone: hangs at Capcom logo;