diff options
| author | 2013-09-15 23:49:35 +0000 | |
|---|---|---|
| committer | 2013-09-15 23:49:35 +0000 | |
| commit | 162959b04f60fe45d3a5126c6b48571b2d1fac9a (patch) | |
| tree | ba7d5b6e76766867de1c7698ea8513ed92e83c99 | |
| parent | a5d4726978018a1e6ae54ea1fbea287138c00cb7 (diff) | |
Fixed fb out-of-bounds writes
| -rw-r--r-- | src/mame/video/powervr2.c | 95 | ||||
| -rw-r--r-- | src/mess/drivers/dccons.c | 2 |
2 files changed, 67 insertions, 30 deletions
diff --git a/src/mame/video/powervr2.c b/src/mame/video/powervr2.c index 7db013801b5..f0ca955e6fe 100644 --- a/src/mame/video/powervr2.c +++ b/src/mame/video/powervr2.c @@ -2996,11 +2996,12 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & UINT32 *fbaddr; UINT32 c; UINT32 r,g,b; - //INT32 vo_horz_start_pos = vo_startx & 0x3ff; UINT8 interlace_on = ((spg_control & 0x10) >> 4); INT32 ystart_f1 = (vo_starty & 0x3ff) << interlace_on; //INT32 ystart_f2 = (vo_starty >> 16) & 0x3ff; INT32 hstart = (vo_startx & 0x3ff); + int res_x,res_y; +// rectangle fbclip; UINT8 unpackmode = (fb_r_ctrl & 0x0000000c) >>2; // aka fb_depth UINT8 enable = (fb_r_ctrl & 0x00000001); @@ -3017,6 +3018,15 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & // popmessage("%d %d %d %d %d",ystart_f1,ystart_f2,interlace_on,spg_vblank & 0x3ff,(spg_vblank >> 16) & 0x3ff); +#if 0 + fbclip.min_x = hstart; + fbclip.min_y = ystart_f1; + fbclip.max_x = hstart + (xi << ((vo_control & 0x100) >> 8)); + fbclip.max_y = ystart_f1 + dy; + + popmessage("%d %d %d %d",fbclip.min_x,fbclip.min_y,fbclip.max_x,fbclip.max_y); +#endif + switch (unpackmode) { case 0x00: // 0555 RGB 16-bit, Cleo Fortune Plus @@ -3028,18 +3038,23 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & { for (x=0;x < xi;x++) { - fbaddr=&bitmap.pix32(y + ystart_f1, x*2+0 + hstart); + res_x = x*2+0 + hstart; + res_y = y + ystart_f1; + + fbaddr=&bitmap.pix32(res_y, res_x); c=*((reinterpret_cast<UINT16 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 1)); b = (c & 0x001f) << 3; g = (c & 0x03e0) >> 2; r = (c & 0x7c00) >> 7; - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); - fbaddr=&bitmap.pix32(y + ystart_f1, x*2+1 + hstart); - if (y<=cliprect.max_y) + res_x = x*2+1 + hstart; + + fbaddr=&bitmap.pix32(res_y, res_x); + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); addrp+=2; } @@ -3048,14 +3063,17 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & { for (x=0;x < xi;x++) { - fbaddr=&bitmap.pix32(y + ystart_f1, x + hstart); + res_x = x + hstart; + res_y = y + ystart_f1; + + fbaddr=&bitmap.pix32(res_y, res_x); c=*((reinterpret_cast<UINT16 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 1)); b = (c & 0x001f) << 3; g = (c & 0x03e0) >> 2; r = (c & 0x7c00) >> 7; - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); addrp+=2; } @@ -3072,19 +3090,23 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & { for (x=0;x < xi;x++) { - fbaddr=&bitmap.pix32(y + ystart_f1, x*2+0 + hstart); + res_x = x*2+0 + hstart; + res_y = y + ystart_f1; + fbaddr=&bitmap.pix32(res_y, res_x); c=*((reinterpret_cast<UINT16 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 1)); b = (c & 0x001f) << 3; g = (c & 0x07e0) >> 3; r = (c & 0xf800) >> 8; - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); - fbaddr=&bitmap.pix32(y + ystart_f1, x*2+1 + hstart); + res_x = x*2+1 + hstart; + //res_y = y + ystart_f1; + fbaddr=&bitmap.pix32(res_y, res_x); - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); addrp+=2; @@ -3094,14 +3116,16 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & { for (x=0;x < xi;x++) { - fbaddr=&bitmap.pix32(y + ystart_f1, x + hstart); + res_x = x + hstart; + res_y = y + ystart_f1; + fbaddr=&bitmap.pix32(res_y, res_x); c=*((reinterpret_cast<UINT16 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 1)); b = (c & 0x001f) << 3; g = (c & 0x07e0) >> 3; r = (c & 0xf800) >> 8; - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); addrp+=2; } @@ -3118,7 +3142,10 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & { for (x=0;x < xi;x++) { - fbaddr=&bitmap.pix32(y + ystart_f1, x*2+0 + hstart); + res_x = x*2+0 + hstart; + res_y = y + ystart_f1; + + fbaddr=&bitmap.pix32(res_y, res_x); c =*(UINT8 *)((reinterpret_cast<UINT8 *>(dc_framebuffer_ram)) + BYTE8_XOR_LE(addrp)); b = c; @@ -3129,11 +3156,13 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & c =*(UINT8 *)((reinterpret_cast<UINT8 *>(dc_framebuffer_ram)) + BYTE8_XOR_LE(addrp+2)); r = c; - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); - fbaddr=&bitmap.pix32(y + ystart_f1, x*2+1 + hstart); - if (y<=cliprect.max_y) + res_x = x*2+1 + hstart; + + fbaddr=&bitmap.pix32(res_y, res_x); + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); addrp+=3; @@ -3143,7 +3172,9 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & { for (x=0;x < xi;x++) { - fbaddr=&bitmap.pix32(y + ystart_f1, x + hstart); + res_x = x + hstart; + res_y = y + ystart_f1; + fbaddr=&bitmap.pix32(res_y, res_x); c =*(UINT8 *)((reinterpret_cast<UINT8 *>(dc_framebuffer_ram)) + BYTE8_XOR_LE(addrp)); b = c; @@ -3154,7 +3185,7 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & c =*(UINT8 *)((reinterpret_cast<UINT8 *>(dc_framebuffer_ram)) + BYTE8_XOR_LE(addrp+2)); r = c; - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); addrp+=3; @@ -3172,18 +3203,23 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & { for (x=0;x < xi;x++) { - fbaddr=&bitmap.pix32(y + ystart_f1, x*2+0 + hstart); + res_x = x*2+0 + hstart; + res_y = y + ystart_f1; + + fbaddr=&bitmap.pix32(res_y, res_x); c =*((reinterpret_cast<UINT32 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 2)); b = (c & 0x0000ff) >> 0; g = (c & 0x00ff00) >> 8; r = (c & 0xff0000) >> 16; - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); - fbaddr=&bitmap.pix32(y + ystart_f1, x*2+1 + hstart); - if (y<=cliprect.max_y) + res_x = x*2+1 + hstart; + + fbaddr=&bitmap.pix32(res_y, res_x); + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); addrp+=4; @@ -3193,14 +3229,16 @@ void powervr2_device::pvr_drawframebuffer(bitmap_rgb32 &bitmap,const rectangle & { for (x=0;x < xi;x++) { - fbaddr=&bitmap.pix32(y + ystart_f1, x + hstart); + res_x = x + hstart; + res_y = y + ystart_f1; + fbaddr=&bitmap.pix32(res_y, res_x); c =*((reinterpret_cast<UINT32 *>(dc_framebuffer_ram)) + (WORD2_XOR_LE(addrp) >> 2)); b = (c & 0x0000ff) >> 0; g = (c & 0x00ff00) >> 8; r = (c & 0xff0000) >> 16; - if (y<=cliprect.max_y) + if (cliprect.contains(res_x, res_y)) *fbaddr = b | (g<<8) | (r<<16); addrp+=4; @@ -3734,11 +3772,8 @@ void powervr2_device::pvr_scanline_timer(int vpos) UINT8 interlace_on = ((spg_control & 0x10) >> 4); dc_state *state = machine().driver_data<dc_state>(); - if(interlace_on) - { - vbin_line <<= 1; - vbout_line <<= 1; - } + vbin_line <<= interlace_on; + vbout_line <<= interlace_on; if(vbin_line-(1+interlace_on) == vpos) state->m_maple->maple_hw_trigger(); diff --git a/src/mess/drivers/dccons.c b/src/mess/drivers/dccons.c index f20289c414a..5c13ab30634 100644 --- a/src/mess/drivers/dccons.c +++ b/src/mess/drivers/dccons.c @@ -20,6 +20,8 @@ TODO: - RTC error always pops up at start-up, no flash plus bug with ticks (needs rewrite) - Inputs doesn't work most of the time; + - Candy Stripe: fills the log with "ATAPI_FEATURES_FLAG_OVL not supported", black screen + - Carrier: Jaleco logo uses YUV, but y size is halved? - F355 Challenge: black screen after Sega logo; - Idol Janshi wo Tsukucchaou: pixel aspect is way wrong (stretched and offsetted horizontally) - Power Stone: hangs at Capcom logo; |
