summaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
author Olivier Galibert <galibert@pobox.com>2021-09-22 20:19:13 +0200
committer Olivier Galibert <galibert@pobox.com>2021-09-22 20:19:38 +0200
commit401dccf05eb2c35697eb6c7406bb689bfa864609 (patch)
tree7f64bddfd826f8c729188c0e9fb7b12050088d0b
parentf6d04b9e87c30feb9525752679bf90815e7866be (diff)
supernova: fix oob access on transcient incorrect sprites, use masking instead of %, silence watchdog access
-rw-r--r--src/mame/drivers/suprnova.cpp1
-rw-r--r--src/mame/video/sknsspr.cpp20
2 files changed, 11 insertions, 10 deletions
diff --git a/src/mame/drivers/suprnova.cpp b/src/mame/drivers/suprnova.cpp
index 26ba609052d..5d6bad2b73b 100644
--- a/src/mame/drivers/suprnova.cpp
+++ b/src/mame/drivers/suprnova.cpp
@@ -744,6 +744,7 @@ void skns_state::skns_map(address_map &map)
map(0x02f00000, 0x02f000ff).rw(FUNC(skns_state::hit_r), FUNC(skns_state::hit_w));
map(0x04000000, 0x041fffff).bankr("bank1"); /* GAME ROM */
map(0x04800000, 0x0483ffff).ram().w(FUNC(skns_state::v3t_w)).share("v3t_ram"); /* tilemap b ram based tiles */
+ map(0x05000000, 0x05000003).nopw(); /* watchdog, probably. Always writes 0 */
map(0x06000000, 0x060fffff).ram().share("main_ram");
map(0xc0000000, 0xc0000fff).ram().share("cache_ram"); /* 'cache' RAM */
}
diff --git a/src/mame/video/sknsspr.cpp b/src/mame/video/sknsspr.cpp
index 43e305321a7..518e2a4bfb5 100644
--- a/src/mame/video/sknsspr.cpp
+++ b/src/mame/video/sknsspr.cpp
@@ -55,23 +55,23 @@ int sknsspr_device::skns_rle_decode ( int romoffset, int size )
int decodeoffset = 0;
while(size>0) {
- u8 code = read_byte((romoffset++) % (1<<27));
+ u8 code = read_byte((romoffset++) & ((1<<27) - 1));
size -= (code & 0x7f) + 1;
if(code & 0x80) { /* (code & 0x7f) normal values will follow */
code &= 0x7f;
do {
- m_decodebuffer[(decodeoffset++)%SUPRNOVA_DECODE_BUFFER_SIZE] = read_byte((romoffset++) % (1<<27));
+ m_decodebuffer[(decodeoffset++) & (SUPRNOVA_DECODE_BUFFER_SIZE-1)] = read_byte((romoffset++) & ((1<<27) - 1));
code--;
} while(code != 0xff);
} else { /* repeat next value (code & 0x7f) times */
- u8 val = read_byte((romoffset++) % (1<<27));
+ u8 val = read_byte((romoffset++) & ((1<<27) - 1));
do {
- m_decodebuffer[(decodeoffset++)%SUPRNOVA_DECODE_BUFFER_SIZE] = val;
+ m_decodebuffer[(decodeoffset++) & (SUPRNOVA_DECODE_BUFFER_SIZE-1)] = val;
code--;
} while(code != 0xff);
}
}
- return romoffset % (1<<27);
+ return romoffset & ((1<<27) - 1);
}
void sknsspr_device::skns_sprite_kludge(int x, int y)
@@ -110,11 +110,11 @@ void sknsspr_device::skns_sprite_kludge(int x, int y)
}
#define z_clamp_x_max() \
- if(x > clip.max_x) { \
+ if(x >= clip.max_x) { \
do { \
bxs += zxs; \
x -= zxd; \
- } while(x > clip.max_x); \
+ } while(x >= clip.max_x); \
}
#define z_clamp_y_min() \
@@ -127,11 +127,11 @@ void sknsspr_device::skns_sprite_kludge(int x, int y)
}
#define z_clamp_y_max() \
- if(y > clip.max_y) { \
+ if(y >= clip.max_y) { \
do { \
bys += zys; \
y -= zyd; \
- } while(y > clip.max_y); \
+ } while(y >= clip.max_y); \
src += (bys>>16)*step_spr; \
}
@@ -156,7 +156,7 @@ void sknsspr_device::skns_sprite_kludge(int x, int y)
while(ys < sy && yd >= clip.min_y)
#define z_draw_pixel() \
- u8 val = src[xs >> 16]; \
+ u8 val = src[(xs >> 16) & 0x3f]; \
if(val) \
bitmap.pix(yd>>16, xd>>16) = val + colour;