From 4877f8d735fe2a7d2a01c2e6611690a857a9a824 Mon Sep 17 00:00:00 2001
From: Olivier Galibert <galibert@pobox.com>
Date: Fri, 8 Dec 2017 17:34:38 +0100
Subject: [PATCH] atarist: Fix out-of-bounds memory scribbling (nw)

---
 src/mame/includes/atarist.h |  1 +
 src/mame/video/atarist.cpp  | 38 +++++++++++++++++++++----------------
 2 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/src/mame/includes/atarist.h b/src/mame/includes/atarist.h
index 0efd590c87f..180dfb4bc9b 100644
--- a/src/mame/includes/atarist.h
+++ b/src/mame/includes/atarist.h
@@ -203,6 +203,7 @@ public:
 	inline pen_t shift_mode_2();
 	void shifter_tick();
 	inline void shifter_load();
+	inline void draw_pixel(int x, int y, u32 pen);
 	void glue_tick();
 	void set_screen_parameters();
 	void blitter_source();
diff --git a/src/mame/video/atarist.cpp b/src/mame/video/atarist.cpp
index b897754b778..045a76a7a1d 100644
--- a/src/mame/video/atarist.cpp
+++ b/src/mame/video/atarist.cpp
@@ -193,6 +193,12 @@ inline void st_state::shifter_load()
 //  glue_tick -
 //-------------------------------------------------
 
+void st_state::draw_pixel(int x, int y, u32 pen)
+{
+	if(x < m_bitmap.width() && y < m_bitmap.height())
+		m_bitmap.pix32(y, x) = pen;
+}
+
 void st_state::glue_tick()
 {
 	int y = machine().first_screen()->vpos();
@@ -241,36 +247,36 @@ void st_state::glue_tick()
 	{
 	case 0:
 		pen = shift_mode_0();
-		m_bitmap.pix32(y, x) = pen;
-		m_bitmap.pix32(y, x+1) = pen;
+		draw_pixel(x, y, pen);
+		draw_pixel(x+1, y, pen);
 		pen = shift_mode_0();
-		m_bitmap.pix32(y, x+2) = pen;
-		m_bitmap.pix32(y, x+3) = pen;
+		draw_pixel(x+2, y, pen);
+		draw_pixel(x+3, y, pen);
 		pen = shift_mode_0();
-		m_bitmap.pix32(y, x+4) = pen;
-		m_bitmap.pix32(y, x+5) = pen;
+		draw_pixel(x+4, y, pen);
+		draw_pixel(x+5, y, pen);
 		pen = shift_mode_0();
-		m_bitmap.pix32(y, x+6) = pen;
-		m_bitmap.pix32(y, x+7) = pen;
+		draw_pixel(x+6, y, pen);
+		draw_pixel(x+7, y, pen);
 		break;
 
 	case 1:
 		pen = shift_mode_1();
-		m_bitmap.pix32(y, x) = pen;
+		draw_pixel(x, y, pen);
 		pen = shift_mode_1();
-		m_bitmap.pix32(y, x+1) = pen;
+		draw_pixel(x+1, y, pen);
 		pen = shift_mode_1();
-		m_bitmap.pix32(y, x+2) = pen;
+		draw_pixel(x+2, y, pen);
 		pen = shift_mode_1();
-		m_bitmap.pix32(y, x+3) = pen;
+		draw_pixel(x+3, y, pen);
 		pen = shift_mode_1();
-		m_bitmap.pix32(y, x+4) = pen;
+		draw_pixel(x+4, y, pen);
 		pen = shift_mode_1();
-		m_bitmap.pix32(y, x+5) = pen;
+		draw_pixel(x+5, y, pen);
 		pen = shift_mode_1();
-		m_bitmap.pix32(y, x+6) = pen;
+		draw_pixel(x+6, y, pen);
 		pen = shift_mode_1();
-		m_bitmap.pix32(y, x+7) = pen;
+		draw_pixel(x+7, y, pen);
 		break;
 
 	case 2: