diff options
author | peterferrie <peter.ferrie@gmail.com> | 2014-10-27 23:33:41 -0700 |
---|---|---|
committer | peterferrie <peter.ferrie@gmail.com> | 2014-10-27 23:33:41 -0700 |
commit | ea2070c139330dd0f3b2c785556c9c647e729149 (patch) | |
tree | 8912fbea1d5fb652c67a6e8216f748babe70e3eb /src/mame/drivers/funworld.c | |
parent | 7b7f2456b90847187707b2447b4143d73837a4b2 (diff) |
rcdino4: fix OOB access
Diffstat (limited to 'src/mame/drivers/funworld.c')
-rw-r--r-- | src/mame/drivers/funworld.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/src/mame/drivers/funworld.c b/src/mame/drivers/funworld.c index 569fcfe1d22..f27c3e12cfb 100644 --- a/src/mame/drivers/funworld.c +++ b/src/mame/drivers/funworld.c @@ -6352,8 +6352,9 @@ DRIVER_INIT_MEMBER(funworld_state, rcdino4) } j = 1; + i = 0x81; - for (i = 0x81; i < (0x81 + ARRAY_LENGTH(rcdino4_keys80));) + do { UINT8 key; @@ -6418,9 +6419,14 @@ DRIVER_INIT_MEMBER(funworld_state, rcdino4) while (j < 0x100); j &= 0xff; - do { - assert((i+1 - 0x81) >= 0 && (i+1 - 0x81) < ARRAY_LENGTH(rcdino4_keys80)); - } while (!rcdino4_keys80[++i - 0x81]); + + do {} while (((++i - 0x81) < ARRAY_LENGTH(rcdino4_keys80)) + && !rcdino4_keys80[i - 0x81]); + + if ((i - 0x81) == ARRAY_LENGTH(rcdino4_keys80)) + { + break; + } if ((i == 0xa4) || (i == 0xb0) @@ -6430,6 +6436,7 @@ DRIVER_INIT_MEMBER(funworld_state, rcdino4) j = 0; /* re-align offset after skipping some pages */ } } + while (1); } DRIVER_INIT_MEMBER(funworld_state, rcdinch) |