Sprinter/mame
2
0
Fork 0
mirror of https://github.com/holub/mame synced 2025-06-02 10:59:52 +03:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

fix array out of bounds access

Browse Source
This commit is contained in:
Michaël Banaan Ananas 2014-08-06 22:35:34 +00:00
parent 52a60e2908
commit 09d527afd6
2 changed files with 35 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
src/emu/machine/rtc4543.c
View File

@ -52,6 +52,7 @@ void rtc4543_device::device_start()
save_item(NAME(m_clk)); save_item(NAME(m_clk));
save_item(NAME(m_wr)); save_item(NAME(m_wr));
save_item(NAME(m_data)); save_item(NAME(m_data));
save_item(NAME(m_shiftreg));
save_item(NAME(m_regs)); save_item(NAME(m_regs));
save_item(NAME(m_curreg)); save_item(NAME(m_curreg));
} }
@ -69,7 +70,9 @@ void rtc4543_device::device_reset()
m_wr = 0; m_wr = 0;
m_clk = 0; m_clk = 0;
m_data = 0; m_data = 0;
m_shiftreg = 0;
m_curreg = 0; m_curreg = 0;
m_curbit = 0;
} }
@ -96,16 +99,16 @@ void rtc4543_device::rtc_clock_updated(int year, int month, int day, int day_of_
{ {
static const int weekday[7] = { 7, 1, 2, 3, 4, 5, 6 }; static const int weekday[7] = { 7, 1, 2, 3, 4, 5, 6 };
m_regs[0] = make_bcd(second); // seconds (BCD, 0-59) in bits 0-6, bit 7 = battery low m_regs[0] = make_bcd(second); // seconds (BCD, 0-59) in bits 0-6, bit 7 = battery low
m_regs[1] = make_bcd(minute); // minutes (BCD, 0-59) m_regs[1] = make_bcd(minute); // minutes (BCD, 0-59)
m_regs[2] = make_bcd(hour); // hour (BCD, 0-23) m_regs[2] = make_bcd(hour); // hour (BCD, 0-23)
m_regs[3] = make_bcd(weekday[day_of_week-1]); // low nibble = day of the week m_regs[3] = make_bcd(weekday[day_of_week - 1]); // low nibble = day of the week
m_regs[3] |= (make_bcd(day) & 0x0f)<<4; // high nibble = low digit of day m_regs[3] |= (make_bcd(day) & 0x0f) << 4; // high nibble = low digit of day
m_regs[4] = (make_bcd(day) >> 4); // low nibble = high digit of day m_regs[4] = (make_bcd(day) >> 4); // low nibble = high digit of day
m_regs[4] |= (make_bcd(month & 0x0f)<<4); // high nibble = low digit of month m_regs[4] |= (make_bcd(month & 0x0f) << 4); // high nibble = low digit of month
m_regs[5] = make_bcd(month & 0x0f) >> 4; // low nibble = high digit of month m_regs[5] = make_bcd(month & 0x0f) >> 4; // low nibble = high digit of month
m_regs[5] |= (make_bcd(year % 10) << 4); // high nibble = low digit of year m_regs[5] |= (make_bcd(year % 10) << 4); // high nibble = low digit of year
m_regs[6] = make_bcd(year % 100) >> 4; // low nibble = tens digit of year (BCD, 0-9) m_regs[6] = make_bcd(year % 100) >> 4; // low nibble = tens digit of year (BCD, 0-9)
} }
//------------------------------------------------- //-------------------------------------------------
@ -116,13 +119,13 @@ WRITE_LINE_MEMBER( rtc4543_device::ce_w )
{ {
if (VERBOSE) printf("RTC4543 '%s' CE: %u\n", tag(), state); if (VERBOSE) printf("RTC4543 '%s' CE: %u\n", tag(), state);
if (!state && m_ce) // complete transfer if (!state && m_ce) // complete transfer
{ {
} }
else if (state && !m_ce) // start new data transfer else if (state && !m_ce) // start new data transfer
{ {
m_curreg = 0; m_curreg = 0;
m_bit = 8; // force immediate reload of output data m_curbit = 0; // force immediate reload of output data
} }
m_ce = state; m_ce = state;
@ -149,25 +152,29 @@ WRITE_LINE_MEMBER( rtc4543_device::clk_w )
if (!m_ce) return; if (!m_ce) return;
if (!m_clk && state) // rising edge - read data becomes valid here // rising edge - read data becomes valid here
if (!m_clk && state)
{ {
if (!m_wr) if (!m_wr)
{ {
if (m_bit > 7) // reload data? // reload data?
if ((m_curbit & 7) == 0)
{ {
m_bit = 0; m_shiftreg = m_regs[m_curreg++];
m_data = m_regs[m_curreg++];
if (VERBOSE) if (VERBOSE)
logerror("RTC4543 '%s' sending byte: %02x\n", tag(), m_data); logerror("RTC4543 '%s' sending byte: %02x\n", tag(), m_shiftreg);
} }
else // no reload, just continue with the current byte
// shift data bit
// note: output data does not change when clk at final bit
if (m_curbit != 55)
{ {
m_data >>= 1; m_data = m_shiftreg & 1;
m_curbit++;
m_shiftreg >>= 1;
data_cb(m_data);
} }
m_bit++;
data_cb(m_data & 0x01);
} }
} }
@ -183,7 +190,7 @@ WRITE_LINE_MEMBER( rtc4543_device::data_w )
{ {
if (VERBOSE) logerror("RTC4543 '%s' I/O: %u\n", tag(), state); if (VERBOSE) logerror("RTC4543 '%s' I/O: %u\n", tag(), state);
m_data |= (state & 1); m_data = state & 1;
} }
@ -193,5 +200,5 @@ WRITE_LINE_MEMBER( rtc4543_device::data_w )
READ_LINE_MEMBER( rtc4543_device::data_r ) READ_LINE_MEMBER( rtc4543_device::data_r )
{ {
return (m_data & 0x80) ? 1 : 0; return m_data;
} }

3
src/emu/machine/rtc4543.h
View File

@ -64,9 +64,10 @@ private:
int m_clk; int m_clk;
int m_wr; int m_wr;
int m_data; int m_data;
int m_shiftreg;
int m_regs[7]; int m_regs[7];
int m_curreg; int m_curreg;
int m_bit; int m_curbit;
// timers // timers
emu_timer *m_clock_timer; emu_timer *m_clock_timer;