diff options
author | Sergey Svishchev <shattered@users.noreply.github.com> | 2018-05-16 11:43:06 +0300 |
---|---|---|
committer | Vas Crabb <cuavas@users.noreply.github.com> | 2018-05-16 18:43:05 +1000 |
commit | c7bda1bc2f2d1edac206df5622405399f8cbe805 (patch) | |
tree | e41f07d3a1434d82d6363bec452fccace8954f60 | |
parent | 680d9e1aeb75a84a764aabe482425c5e32056664 (diff) |
video/hp1ll3: add runtime bounds check in CONF command (issue#3523) (nw) (#3547)
* video/hp1ll3: add runtime bounds check in CONF command (issue#3523) (nw)
* report unexpected CONF words if they are received (nw)
-rw-r--r-- | src/devices/video/hp1ll3.cpp | 26 | ||||
-rw-r--r-- | src/devices/video/hp1ll3.h | 2 |
2 files changed, 16 insertions, 12 deletions
diff --git a/src/devices/video/hp1ll3.cpp b/src/devices/video/hp1ll3.cpp index 5d15ada47e5..380fc6aa250 100644 --- a/src/devices/video/hp1ll3.cpp +++ b/src/devices/video/hp1ll3.cpp @@ -47,7 +47,7 @@ * 0 -- no data * 1 -- write 1 word of data, then command * 2 -- write 2 words of data, then command - * 3 -- write command, then 11 words of data (= CONF only?) + * 3 -- write command, then 12 words of data (= CONF only?) * 4 -- write 1 word of data, then command, then write X words of data, then write NOP * * (read) @@ -569,18 +569,22 @@ WRITE8_MEMBER( hp1ll3_device::write ) switch (m_command) { case CONF: - assert((m_conf_ptr >> 1) < ARRAY_LENGTH(m_conf)); - if (m_conf_ptr & 1) { - m_conf[m_conf_ptr >> 1] |= data; + if (m_conf_ptr < 2 * ARRAY_LENGTH(m_conf)) { + if (m_conf_ptr & 1) { + m_conf[m_conf_ptr >> 1] |= data; + DBG_LOG(1,"HPGPU",("CONF data word %d received: %04X\n", m_conf_ptr >> 1, m_conf[m_conf_ptr >> 1])); + } else { + m_conf[m_conf_ptr >> 1] = data << 8; + } } else { - m_conf[m_conf_ptr >> 1] = data << 8; - } - if (m_conf_ptr++ == 22) { - DBG_LOG(2,"HPGPU",("CONF data received: %04X %04X %04X %04X %04X %04X %04X %04X %04X %04X %04X\n", - m_conf[0], m_conf[1], m_conf[2], m_conf[3], - m_conf[4], m_conf[5], m_conf[6], m_conf[7], - m_conf[8], m_conf[9], m_conf[10])); + if (m_conf_ptr & 1) { + m_input[0] |= data; + DBG_LOG(1,"HPGPU",("unexpected CONF data word %d discarded: %04X\n", m_conf_ptr >> 1, m_input[0])); + } else { + m_input[0] = data << 8; + } } + m_conf_ptr++; break; case WRMEM: diff --git a/src/devices/video/hp1ll3.h b/src/devices/video/hp1ll3.h index dfeb1e83551..b8c9b45e007 100644 --- a/src/devices/video/hp1ll3.h +++ b/src/devices/video/hp1ll3.h @@ -51,7 +51,7 @@ private: void line(int x_from, int y_from, int x_to, int y_to); void bitblt(int dstx, int dsty, uint16_t srcaddr, int width, int height, int op); - uint16_t m_conf[11], m_input[2]; + uint16_t m_conf[12], m_input[2]; int m_input_ptr, m_memory_ptr, m_conf_ptr; int m_command, m_horiz_pix_total, m_vert_pix_total; |