From 5a4efb733373983f44b2e6cc9abde85a67e04fe4 Mon Sep 17 00:00:00 2001 From: Michael Zapf Date: Fri, 21 Dec 2018 21:49:00 +0100 Subject: ti99: Reject oversized cartridge dumps to avoid memory corruption. --- src/devices/bus/ti99/gromport/cartridges.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/src/devices/bus/ti99/gromport/cartridges.cpp b/src/devices/bus/ti99/gromport/cartridges.cpp index e116d00b6e9..7e93029f97f 100644 --- a/src/devices/bus/ti99/gromport/cartridges.cpp +++ b/src/devices/bus/ti99/gromport/cartridges.cpp @@ -138,6 +138,7 @@ void ti99_cartridge_device::prepare_cartridge() m_pcb->m_rom_size = loaded_through_softlist() ? get_software_region_length("rom") : m_rpk->get_resource_length("rom_socket"); if (m_pcb->m_rom_size > 0) { + if (m_pcb->m_rom_size > 0x200000) fatalerror("Cartridge ROM size exceeding 2 MiB"); LOGMASKED(LOG_CONFIG, "rom size=0x%04x\n", m_pcb->m_rom_size); regr = memregion(CARTROM_TAG); rom_ptr = loaded_through_softlist() ? get_software_region("rom") : m_rpk->get_contents_of_socket("rom_socket"); -- cgit v1.2.3