diff options
author | balr0g <balrog032@gmail.com> | 2016-03-16 16:55:22 -0400 |
---|---|---|
committer | balr0g <balrog032@gmail.com> | 2016-03-16 16:55:54 -0400 |
commit | 3326bc6fab1747089743995c958a9df9823f432a (patch) | |
tree | c3e0cf196f09c8cda650724c289c3d59679754ca /src/devices/bus/gba | |
parent | e89f4ae6ba3a807e882fb70101581bcba3c2bf1a (diff) |
Fix crash on load due to buffer overrun in gba cart loader (nw)
Diffstat (limited to 'src/devices/bus/gba')
-rw-r--r-- | src/devices/bus/gba/gba_slot.cpp | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/src/devices/bus/gba/gba_slot.cpp b/src/devices/bus/gba/gba_slot.cpp index 10c5d45a0a8..737ff5fa6ed 100644 --- a/src/devices/bus/gba/gba_slot.cpp +++ b/src/devices/bus/gba/gba_slot.cpp @@ -295,17 +295,17 @@ int gba_cart_slot_device::get_cart_type(UINT8 *ROM, UINT32 len) // first detect nvram type based on strings inside the file for (int i = 0; i < len; i++) { - if (!memcmp(&ROM[i], "EEPROM_V", 8)) + if ((i<len-8) && !memcmp(&ROM[i], "EEPROM_V", 8)) chip |= GBA_CHIP_EEPROM; // should be either GBA_CHIP_EEPROM_4K or GBA_CHIP_EEPROM_64K, but it is not yet possible to automatically detect which one - else if ((!memcmp(&ROM[i], "SRAM_V", 6)) || (!memcmp(&ROM[i], "SRAM_F_V", 8))) // || (!memcmp(&data[i], "ADVANCEWARS", 11))) //advance wars 1 & 2 has SRAM, but no "SRAM_" string can be found inside the ROM space + else if (((i<len-6) && !memcmp(&ROM[i], "SRAM_V", 6)) || ((i<len-8) && !memcmp(&ROM[i], "SRAM_F_V", 8))) // || ((i<len-11) && !memcmp(&data[i], "ADVANCEWARS", 11))) //advance wars 1 & 2 has SRAM, but no "SRAM_" string can be found inside the ROM space chip |= GBA_CHIP_SRAM; - else if (!memcmp(&ROM[i], "FLASH1M_V", 9)) + else if ((i<len-9) && !memcmp(&ROM[i], "FLASH1M_V", 9)) chip |= GBA_CHIP_FLASH_1M; - else if (!memcmp(&ROM[i], "FLASH512_V", 10)) + else if ((i<len-10) && !memcmp(&ROM[i], "FLASH512_V", 10)) chip |= GBA_CHIP_FLASH_512; - else if (!memcmp(&ROM[i], "FLASH_V", 7)) + else if ((i<len-7) && !memcmp(&ROM[i], "FLASH_V", 7)) chip |= GBA_CHIP_FLASH; - else if (!memcmp(&ROM[i], "SIIRTC_V", 8)) + else if ((i<len-8) && !memcmp(&ROM[i], "SIIRTC_V", 8)) chip |= GBA_CHIP_RTC; } osd_printf_info("GBA: Detected (ROM) %s\n", gba_chip_string(chip).c_str()); |