diff options
author | Michael Zapf <Michael.Zapf@mizapf.de> | 2018-12-21 21:49:00 +0100 |
---|---|---|
committer | Michael Zapf <Michael.Zapf@mizapf.de> | 2018-12-21 21:49:00 +0100 |
commit | 5a4efb733373983f44b2e6cc9abde85a67e04fe4 (patch) | |
tree | 640c53662d0fd043b7e48a4ed00181fd47c14c52 | |
parent | 284be7e18f732f6a73ef94754f6f337ab4eaba45 (diff) |
ti99: Reject oversized cartridge dumps to avoid memory corruption.
-rw-r--r-- | src/devices/bus/ti99/gromport/cartridges.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/devices/bus/ti99/gromport/cartridges.cpp b/src/devices/bus/ti99/gromport/cartridges.cpp index e116d00b6e9..7e93029f97f 100644 --- a/src/devices/bus/ti99/gromport/cartridges.cpp +++ b/src/devices/bus/ti99/gromport/cartridges.cpp @@ -138,6 +138,7 @@ void ti99_cartridge_device::prepare_cartridge() m_pcb->m_rom_size = loaded_through_softlist() ? get_software_region_length("rom") : m_rpk->get_resource_length("rom_socket"); if (m_pcb->m_rom_size > 0) { + if (m_pcb->m_rom_size > 0x200000) fatalerror("Cartridge ROM size exceeding 2 MiB"); LOGMASKED(LOG_CONFIG, "rom size=0x%04x\n", m_pcb->m_rom_size); regr = memregion(CARTROM_TAG); rom_ptr = loaded_through_softlist() ? get_software_region("rom") : m_rpk->get_contents_of_socket("rom_socket"); |