summaryrefslogtreecommitdiffstatshomepage
path: root/src/devices
diff options
context:
space:
mode:
author Sergey Svishchev <shattered@users.noreply.github.com>2018-05-16 11:43:06 +0300
committer Vas Crabb <cuavas@users.noreply.github.com>2018-05-16 18:43:05 +1000
commitc7bda1bc2f2d1edac206df5622405399f8cbe805 (patch)
treee41f07d3a1434d82d6363bec452fccace8954f60 /src/devices
parent680d9e1aeb75a84a764aabe482425c5e32056664 (diff)
video/hp1ll3: add runtime bounds check in CONF command (issue#3523) (nw) (#3547)
* video/hp1ll3: add runtime bounds check in CONF command (issue#3523) (nw) * report unexpected CONF words if they are received (nw)
Diffstat (limited to 'src/devices')
-rw-r--r--src/devices/video/hp1ll3.cpp26
-rw-r--r--src/devices/video/hp1ll3.h2
2 files changed, 16 insertions, 12 deletions
diff --git a/src/devices/video/hp1ll3.cpp b/src/devices/video/hp1ll3.cpp
index 5d15ada47e5..380fc6aa250 100644
--- a/src/devices/video/hp1ll3.cpp
+++ b/src/devices/video/hp1ll3.cpp
@@ -47,7 +47,7 @@
* 0 -- no data
* 1 -- write 1 word of data, then command
* 2 -- write 2 words of data, then command
- * 3 -- write command, then 11 words of data (= CONF only?)
+ * 3 -- write command, then 12 words of data (= CONF only?)
* 4 -- write 1 word of data, then command, then write X words of data, then write NOP
*
* (read)
@@ -569,18 +569,22 @@ WRITE8_MEMBER( hp1ll3_device::write )
switch (m_command)
{
case CONF:
- assert((m_conf_ptr >> 1) < ARRAY_LENGTH(m_conf));
- if (m_conf_ptr & 1) {
- m_conf[m_conf_ptr >> 1] |= data;
+ if (m_conf_ptr < 2 * ARRAY_LENGTH(m_conf)) {
+ if (m_conf_ptr & 1) {
+ m_conf[m_conf_ptr >> 1] |= data;
+ DBG_LOG(1,"HPGPU",("CONF data word %d received: %04X\n", m_conf_ptr >> 1, m_conf[m_conf_ptr >> 1]));
+ } else {
+ m_conf[m_conf_ptr >> 1] = data << 8;
+ }
} else {
- m_conf[m_conf_ptr >> 1] = data << 8;
- }
- if (m_conf_ptr++ == 22) {
- DBG_LOG(2,"HPGPU",("CONF data received: %04X %04X %04X %04X %04X %04X %04X %04X %04X %04X %04X\n",
- m_conf[0], m_conf[1], m_conf[2], m_conf[3],
- m_conf[4], m_conf[5], m_conf[6], m_conf[7],
- m_conf[8], m_conf[9], m_conf[10]));
+ if (m_conf_ptr & 1) {
+ m_input[0] |= data;
+ DBG_LOG(1,"HPGPU",("unexpected CONF data word %d discarded: %04X\n", m_conf_ptr >> 1, m_input[0]));
+ } else {
+ m_input[0] = data << 8;
+ }
}
+ m_conf_ptr++;
break;
case WRMEM:
diff --git a/src/devices/video/hp1ll3.h b/src/devices/video/hp1ll3.h
index dfeb1e83551..b8c9b45e007 100644
--- a/src/devices/video/hp1ll3.h
+++ b/src/devices/video/hp1ll3.h
@@ -51,7 +51,7 @@ private:
void line(int x_from, int y_from, int x_to, int y_to);
void bitblt(int dstx, int dsty, uint16_t srcaddr, int width, int height, int op);
- uint16_t m_conf[11], m_input[2];
+ uint16_t m_conf[12], m_input[2];
int m_input_ptr, m_memory_ptr, m_conf_ptr;
int m_command, m_horiz_pix_total, m_vert_pix_total;