summaryrefslogtreecommitdiffstatshomepage
path: root/src/devices/bus/gba
diff options
context:
space:
mode:
author balr0g <balrog032@gmail.com>2016-03-16 16:55:22 -0400
committer balr0g <balrog032@gmail.com>2016-03-16 16:55:54 -0400
commit3326bc6fab1747089743995c958a9df9823f432a (patch)
treec3e0cf196f09c8cda650724c289c3d59679754ca /src/devices/bus/gba
parente89f4ae6ba3a807e882fb70101581bcba3c2bf1a (diff)
Fix crash on load due to buffer overrun in gba cart loader (nw)
Diffstat (limited to 'src/devices/bus/gba')
-rw-r--r--src/devices/bus/gba/gba_slot.cpp12
1 files changed, 6 insertions, 6 deletions
diff --git a/src/devices/bus/gba/gba_slot.cpp b/src/devices/bus/gba/gba_slot.cpp
index 10c5d45a0a8..737ff5fa6ed 100644
--- a/src/devices/bus/gba/gba_slot.cpp
+++ b/src/devices/bus/gba/gba_slot.cpp
@@ -295,17 +295,17 @@ int gba_cart_slot_device::get_cart_type(UINT8 *ROM, UINT32 len)
// first detect nvram type based on strings inside the file
for (int i = 0; i < len; i++)
{
- if (!memcmp(&ROM[i], "EEPROM_V", 8))
+ if ((i<len-8) && !memcmp(&ROM[i], "EEPROM_V", 8))
chip |= GBA_CHIP_EEPROM; // should be either GBA_CHIP_EEPROM_4K or GBA_CHIP_EEPROM_64K, but it is not yet possible to automatically detect which one
- else if ((!memcmp(&ROM[i], "SRAM_V", 6)) || (!memcmp(&ROM[i], "SRAM_F_V", 8))) // || (!memcmp(&data[i], "ADVANCEWARS", 11))) //advance wars 1 & 2 has SRAM, but no "SRAM_" string can be found inside the ROM space
+ else if (((i<len-6) && !memcmp(&ROM[i], "SRAM_V", 6)) || ((i<len-8) && !memcmp(&ROM[i], "SRAM_F_V", 8))) // || ((i<len-11) && !memcmp(&data[i], "ADVANCEWARS", 11))) //advance wars 1 & 2 has SRAM, but no "SRAM_" string can be found inside the ROM space
chip |= GBA_CHIP_SRAM;
- else if (!memcmp(&ROM[i], "FLASH1M_V", 9))
+ else if ((i<len-9) && !memcmp(&ROM[i], "FLASH1M_V", 9))
chip |= GBA_CHIP_FLASH_1M;
- else if (!memcmp(&ROM[i], "FLASH512_V", 10))
+ else if ((i<len-10) && !memcmp(&ROM[i], "FLASH512_V", 10))
chip |= GBA_CHIP_FLASH_512;
- else if (!memcmp(&ROM[i], "FLASH_V", 7))
+ else if ((i<len-7) && !memcmp(&ROM[i], "FLASH_V", 7))
chip |= GBA_CHIP_FLASH;
- else if (!memcmp(&ROM[i], "SIIRTC_V", 8))
+ else if ((i<len-8) && !memcmp(&ROM[i], "SIIRTC_V", 8))
chip |= GBA_CHIP_RTC;
}
osd_printf_info("GBA: Detected (ROM) %s\n", gba_chip_string(chip).c_str());