diff options
author | AJR <ajrhacker@users.noreply.github.com> | 2022-04-10 11:08:20 -0400 |
---|---|---|
committer | AJR <ajrhacker@users.noreply.github.com> | 2022-04-10 11:13:18 -0400 |
commit | 810fd2a9519142f62caad7555c0315d7c598a2cb (patch) | |
tree | 21ef976b0b6d9ad0535d481b091edb68f0b829fd /src/mame/machine | |
parent | 2509d8b900fcce3b6c3c8d1580046b1f45306951 (diff) |
apple1.cpp, microtan.cpp, mtx.cpp, vtech1.cpp: Eliminate use of device_image_interface::ptr() method
* vtech1.cpp: Correct fencepost error in snapshot loader
Diffstat (limited to 'src/mame/machine')
-rw-r--r-- | src/mame/machine/microtan.cpp | 21 | ||||
-rw-r--r-- | src/mame/machine/mtx.cpp | 51 |
2 files changed, 59 insertions, 13 deletions
diff --git a/src/mame/machine/microtan.cpp b/src/mame/machine/microtan.cpp index b71982061f5..2c9504c5ff4 100644 --- a/src/mame/machine/microtan.cpp +++ b/src/mame/machine/microtan.cpp @@ -667,14 +667,27 @@ void microtan_state::snapshot_copy(uint8_t *snapshot_buff, int snapshot_size) SNAPSHOT_LOAD_MEMBER(microtan_state::snapshot_cb) { - uint8_t *snapshot_buff = (uint8_t*)image.ptr(); - if (!snapshot_buff) + uint64_t snapshot_len = image.length(); + if (snapshot_len < 4 || snapshot_len >= 66000) + { + //image.seterror(image_error::INVALIDIMAGE); + return image_init_result::FAIL; + } + + auto snapshot_buff = std::make_unique<uint8_t []>(snapshot_len); + if (image.fread(snapshot_buff.get(), snapshot_len) != snapshot_len) + { + //image.seterror(image_error::UNSPECIFIED); return image_init_result::FAIL; + } - if (verify_snapshot(snapshot_buff, image.length()) != image_verify_result::PASS) + if (verify_snapshot(snapshot_buff.get(), snapshot_len) != image_verify_result::PASS) + { + //image.seterror(image_error::INVALIDIMAGE); return image_init_result::FAIL; + } - snapshot_copy(snapshot_buff, image.length()); + snapshot_copy(snapshot_buff.get(), snapshot_len); return image_init_result::PASS; } diff --git a/src/mame/machine/mtx.cpp b/src/mame/machine/mtx.cpp index 3cccaa3d7bf..41cffc13e11 100644 --- a/src/mame/machine/mtx.cpp +++ b/src/mame/machine/mtx.cpp @@ -435,8 +435,26 @@ DEVICE_IMAGE_LOAD_MEMBER( mtx_state::rompak_load ) // more data from tape. todo: tapes which autorun after loading SNAPSHOT_LOAD_MEMBER(mtx_state::snapshot_cb) { - address_space &program = m_maincpu->space(AS_PROGRAM); - uint8_t *data = (uint8_t*)image.ptr(); + uint64_t length = image.length(); + + if (length < 18) + { + image.seterror(image_error::INVALIDIMAGE, "File too short"); + return image_init_result::FAIL; + } + + if (length >= 0x10000 - 0x4000 + 18) + { + image.seterror(image_error::INVALIDIMAGE, "File too long"); + return image_init_result::FAIL; + } + + auto data = std::make_unique<uint8_t []>(length); + if (image.fread(data.get(), length) != length) + { + image.seterror(image_error::UNSPECIFIED, "Error reading file"); + return image_init_result::FAIL; + } // verify first byte if (data[0] != 0xff) @@ -451,11 +469,13 @@ SNAPSHOT_LOAD_MEMBER(mtx_state::snapshot_cb) tape_name[15] = '\0'; image.message("Loading '%s'", tape_name); + address_space &program = m_maincpu->space(AS_PROGRAM); + // reset memory map bankswitch(0); // start of system variables area - uint16_t system_variables_base = pick_integer_le(data, 16, 2); + uint16_t system_variables_base = pick_integer_le(data.get(), 16, 2); // write system variables uint16_t system_variables_size = 0; @@ -483,19 +503,31 @@ SNAPSHOT_LOAD_MEMBER(mtx_state::snapshot_cb) QUICKLOAD_LOAD_MEMBER(mtx_state::quickload_cb) { - address_space &program = m_maincpu->space(AS_PROGRAM); - uint8_t *data = (uint8_t*)image.ptr(); + uint64_t length = image.length(); - if (image.length() < 4) + if (length < 4) { image.seterror(image_error::INVALIDIMAGE, "File too short"); return image_init_result::FAIL; } - uint16_t code_base = pick_integer_le(data, 0, 2); - uint16_t code_length = pick_integer_le(data, 2, 2); + if (length >= 0x10000 - 0x4000 + 4) + { + image.seterror(image_error::INVALIDIMAGE, "File too long"); + return image_init_result::FAIL; + } - if (image.length() < code_length) + auto data = std::make_unique<uint8_t []>(length); + if (image.fread(data.get(), length) != length) + { + image.seterror(image_error::UNSPECIFIED, "Error reading file"); + return image_init_result::FAIL; + } + + uint16_t code_base = pick_integer_le(data.get(), 0, 2); + uint16_t code_length = pick_integer_le(data.get(), 2, 2); + + if (length < code_length) { image.seterror(image_error::INVALIDIMAGE, "File too short"); return image_init_result::FAIL; @@ -511,6 +543,7 @@ QUICKLOAD_LOAD_MEMBER(mtx_state::quickload_cb) bankswitch(0); // write image data + address_space &program = m_maincpu->space(AS_PROGRAM); for (int i = 0; i < code_length; i++) program.write_byte(code_base + i, data[4 + i]); |