summaryrefslogtreecommitdiffstatshomepage
path: root/src/mame/machine
diff options
context:
space:
mode:
author AJR <ajrhacker@users.noreply.github.com>2022-04-10 11:08:20 -0400
committer AJR <ajrhacker@users.noreply.github.com>2022-04-10 11:13:18 -0400
commit810fd2a9519142f62caad7555c0315d7c598a2cb (patch)
tree21ef976b0b6d9ad0535d481b091edb68f0b829fd /src/mame/machine
parent2509d8b900fcce3b6c3c8d1580046b1f45306951 (diff)
apple1.cpp, microtan.cpp, mtx.cpp, vtech1.cpp: Eliminate use of device_image_interface::ptr() method
* vtech1.cpp: Correct fencepost error in snapshot loader
Diffstat (limited to 'src/mame/machine')
-rw-r--r--src/mame/machine/microtan.cpp21
-rw-r--r--src/mame/machine/mtx.cpp51
2 files changed, 59 insertions, 13 deletions
diff --git a/src/mame/machine/microtan.cpp b/src/mame/machine/microtan.cpp
index b71982061f5..2c9504c5ff4 100644
--- a/src/mame/machine/microtan.cpp
+++ b/src/mame/machine/microtan.cpp
@@ -667,14 +667,27 @@ void microtan_state::snapshot_copy(uint8_t *snapshot_buff, int snapshot_size)
SNAPSHOT_LOAD_MEMBER(microtan_state::snapshot_cb)
{
- uint8_t *snapshot_buff = (uint8_t*)image.ptr();
- if (!snapshot_buff)
+ uint64_t snapshot_len = image.length();
+ if (snapshot_len < 4 || snapshot_len >= 66000)
+ {
+ //image.seterror(image_error::INVALIDIMAGE);
+ return image_init_result::FAIL;
+ }
+
+ auto snapshot_buff = std::make_unique<uint8_t []>(snapshot_len);
+ if (image.fread(snapshot_buff.get(), snapshot_len) != snapshot_len)
+ {
+ //image.seterror(image_error::UNSPECIFIED);
return image_init_result::FAIL;
+ }
- if (verify_snapshot(snapshot_buff, image.length()) != image_verify_result::PASS)
+ if (verify_snapshot(snapshot_buff.get(), snapshot_len) != image_verify_result::PASS)
+ {
+ //image.seterror(image_error::INVALIDIMAGE);
return image_init_result::FAIL;
+ }
- snapshot_copy(snapshot_buff, image.length());
+ snapshot_copy(snapshot_buff.get(), snapshot_len);
return image_init_result::PASS;
}
diff --git a/src/mame/machine/mtx.cpp b/src/mame/machine/mtx.cpp
index 3cccaa3d7bf..41cffc13e11 100644
--- a/src/mame/machine/mtx.cpp
+++ b/src/mame/machine/mtx.cpp
@@ -435,8 +435,26 @@ DEVICE_IMAGE_LOAD_MEMBER( mtx_state::rompak_load )
// more data from tape. todo: tapes which autorun after loading
SNAPSHOT_LOAD_MEMBER(mtx_state::snapshot_cb)
{
- address_space &program = m_maincpu->space(AS_PROGRAM);
- uint8_t *data = (uint8_t*)image.ptr();
+ uint64_t length = image.length();
+
+ if (length < 18)
+ {
+ image.seterror(image_error::INVALIDIMAGE, "File too short");
+ return image_init_result::FAIL;
+ }
+
+ if (length >= 0x10000 - 0x4000 + 18)
+ {
+ image.seterror(image_error::INVALIDIMAGE, "File too long");
+ return image_init_result::FAIL;
+ }
+
+ auto data = std::make_unique<uint8_t []>(length);
+ if (image.fread(data.get(), length) != length)
+ {
+ image.seterror(image_error::UNSPECIFIED, "Error reading file");
+ return image_init_result::FAIL;
+ }
// verify first byte
if (data[0] != 0xff)
@@ -451,11 +469,13 @@ SNAPSHOT_LOAD_MEMBER(mtx_state::snapshot_cb)
tape_name[15] = '\0';
image.message("Loading '%s'", tape_name);
+ address_space &program = m_maincpu->space(AS_PROGRAM);
+
// reset memory map
bankswitch(0);
// start of system variables area
- uint16_t system_variables_base = pick_integer_le(data, 16, 2);
+ uint16_t system_variables_base = pick_integer_le(data.get(), 16, 2);
// write system variables
uint16_t system_variables_size = 0;
@@ -483,19 +503,31 @@ SNAPSHOT_LOAD_MEMBER(mtx_state::snapshot_cb)
QUICKLOAD_LOAD_MEMBER(mtx_state::quickload_cb)
{
- address_space &program = m_maincpu->space(AS_PROGRAM);
- uint8_t *data = (uint8_t*)image.ptr();
+ uint64_t length = image.length();
- if (image.length() < 4)
+ if (length < 4)
{
image.seterror(image_error::INVALIDIMAGE, "File too short");
return image_init_result::FAIL;
}
- uint16_t code_base = pick_integer_le(data, 0, 2);
- uint16_t code_length = pick_integer_le(data, 2, 2);
+ if (length >= 0x10000 - 0x4000 + 4)
+ {
+ image.seterror(image_error::INVALIDIMAGE, "File too long");
+ return image_init_result::FAIL;
+ }
- if (image.length() < code_length)
+ auto data = std::make_unique<uint8_t []>(length);
+ if (image.fread(data.get(), length) != length)
+ {
+ image.seterror(image_error::UNSPECIFIED, "Error reading file");
+ return image_init_result::FAIL;
+ }
+
+ uint16_t code_base = pick_integer_le(data.get(), 0, 2);
+ uint16_t code_length = pick_integer_le(data.get(), 2, 2);
+
+ if (length < code_length)
{
image.seterror(image_error::INVALIDIMAGE, "File too short");
return image_init_result::FAIL;
@@ -511,6 +543,7 @@ QUICKLOAD_LOAD_MEMBER(mtx_state::quickload_cb)
bankswitch(0);
// write image data
+ address_space &program = m_maincpu->space(AS_PROGRAM);
for (int i = 0; i < code_length; i++)
program.write_byte(code_base + i, data[4 + i]);