diff options
author | Olivier Galibert <galibert@pobox.com> | 2021-09-22 20:19:13 +0200 |
---|---|---|
committer | Olivier Galibert <galibert@pobox.com> | 2021-09-22 20:19:38 +0200 |
commit | 401dccf05eb2c35697eb6c7406bb689bfa864609 (patch) | |
tree | 7f64bddfd826f8c729188c0e9fb7b12050088d0b | |
parent | f6d04b9e87c30feb9525752679bf90815e7866be (diff) |
supernova: fix oob access on transcient incorrect sprites, use masking instead of %, silence watchdog access
-rw-r--r-- | src/mame/drivers/suprnova.cpp | 1 | ||||
-rw-r--r-- | src/mame/video/sknsspr.cpp | 20 |
2 files changed, 11 insertions, 10 deletions
diff --git a/src/mame/drivers/suprnova.cpp b/src/mame/drivers/suprnova.cpp index 26ba609052d..5d6bad2b73b 100644 --- a/src/mame/drivers/suprnova.cpp +++ b/src/mame/drivers/suprnova.cpp @@ -744,6 +744,7 @@ void skns_state::skns_map(address_map &map) map(0x02f00000, 0x02f000ff).rw(FUNC(skns_state::hit_r), FUNC(skns_state::hit_w)); map(0x04000000, 0x041fffff).bankr("bank1"); /* GAME ROM */ map(0x04800000, 0x0483ffff).ram().w(FUNC(skns_state::v3t_w)).share("v3t_ram"); /* tilemap b ram based tiles */ + map(0x05000000, 0x05000003).nopw(); /* watchdog, probably. Always writes 0 */ map(0x06000000, 0x060fffff).ram().share("main_ram"); map(0xc0000000, 0xc0000fff).ram().share("cache_ram"); /* 'cache' RAM */ } diff --git a/src/mame/video/sknsspr.cpp b/src/mame/video/sknsspr.cpp index 43e305321a7..518e2a4bfb5 100644 --- a/src/mame/video/sknsspr.cpp +++ b/src/mame/video/sknsspr.cpp @@ -55,23 +55,23 @@ int sknsspr_device::skns_rle_decode ( int romoffset, int size ) int decodeoffset = 0; while(size>0) { - u8 code = read_byte((romoffset++) % (1<<27)); + u8 code = read_byte((romoffset++) & ((1<<27) - 1)); size -= (code & 0x7f) + 1; if(code & 0x80) { /* (code & 0x7f) normal values will follow */ code &= 0x7f; do { - m_decodebuffer[(decodeoffset++)%SUPRNOVA_DECODE_BUFFER_SIZE] = read_byte((romoffset++) % (1<<27)); + m_decodebuffer[(decodeoffset++) & (SUPRNOVA_DECODE_BUFFER_SIZE-1)] = read_byte((romoffset++) & ((1<<27) - 1)); code--; } while(code != 0xff); } else { /* repeat next value (code & 0x7f) times */ - u8 val = read_byte((romoffset++) % (1<<27)); + u8 val = read_byte((romoffset++) & ((1<<27) - 1)); do { - m_decodebuffer[(decodeoffset++)%SUPRNOVA_DECODE_BUFFER_SIZE] = val; + m_decodebuffer[(decodeoffset++) & (SUPRNOVA_DECODE_BUFFER_SIZE-1)] = val; code--; } while(code != 0xff); } } - return romoffset % (1<<27); + return romoffset & ((1<<27) - 1); } void sknsspr_device::skns_sprite_kludge(int x, int y) @@ -110,11 +110,11 @@ void sknsspr_device::skns_sprite_kludge(int x, int y) } #define z_clamp_x_max() \ - if(x > clip.max_x) { \ + if(x >= clip.max_x) { \ do { \ bxs += zxs; \ x -= zxd; \ - } while(x > clip.max_x); \ + } while(x >= clip.max_x); \ } #define z_clamp_y_min() \ @@ -127,11 +127,11 @@ void sknsspr_device::skns_sprite_kludge(int x, int y) } #define z_clamp_y_max() \ - if(y > clip.max_y) { \ + if(y >= clip.max_y) { \ do { \ bys += zys; \ y -= zyd; \ - } while(y > clip.max_y); \ + } while(y >= clip.max_y); \ src += (bys>>16)*step_spr; \ } @@ -156,7 +156,7 @@ void sknsspr_device::skns_sprite_kludge(int x, int y) while(ys < sy && yd >= clip.min_y) #define z_draw_pixel() \ - u8 val = src[xs >> 16]; \ + u8 val = src[(xs >> 16) & 0x3f]; \ if(val) \ bitmap.pix(yd>>16, xd>>16) = val + colour; |