summaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
author Michael Zapf <Michael.Zapf@mizapf.de>2018-12-21 21:49:00 +0100
committer Michael Zapf <Michael.Zapf@mizapf.de>2018-12-21 21:49:00 +0100
commit5a4efb733373983f44b2e6cc9abde85a67e04fe4 (patch)
tree640c53662d0fd043b7e48a4ed00181fd47c14c52
parent284be7e18f732f6a73ef94754f6f337ab4eaba45 (diff)
ti99: Reject oversized cartridge dumps to avoid memory corruption.
-rw-r--r--src/devices/bus/ti99/gromport/cartridges.cpp1
1 files changed, 1 insertions, 0 deletions
diff --git a/src/devices/bus/ti99/gromport/cartridges.cpp b/src/devices/bus/ti99/gromport/cartridges.cpp
index e116d00b6e9..7e93029f97f 100644
--- a/src/devices/bus/ti99/gromport/cartridges.cpp
+++ b/src/devices/bus/ti99/gromport/cartridges.cpp
@@ -138,6 +138,7 @@ void ti99_cartridge_device::prepare_cartridge()
m_pcb->m_rom_size = loaded_through_softlist() ? get_software_region_length("rom") : m_rpk->get_resource_length("rom_socket");
if (m_pcb->m_rom_size > 0)
{
+ if (m_pcb->m_rom_size > 0x200000) fatalerror("Cartridge ROM size exceeding 2 MiB");
LOGMASKED(LOG_CONFIG, "rom size=0x%04x\n", m_pcb->m_rom_size);
regr = memregion(CARTROM_TAG);
rom_ptr = loaded_through_softlist() ? get_software_region("rom") : m_rpk->get_contents_of_socket("rom_socket");