From 50c0632bfbf35cf49d39931cf8376f1259255aa8 Mon Sep 17 00:00:00 2001
From: hap <happppp@users.noreply.github.com>
Date: Fri, 16 Apr 2021 16:48:22 +0200
Subject: [PATCH] smartboard: add safeguards for invalid read

---
 src/mame/drivers/tasc.cpp       |  1 +
 src/mame/machine/smartboard.cpp | 32 ++++++++++++++++++++------------
 src/mame/machine/smartboard.h   |  2 +-
 3 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/src/mame/drivers/tasc.cpp b/src/mame/drivers/tasc.cpp
index 2b5053122ce..e20f06c7729 100644
--- a/src/mame/drivers/tasc.cpp
+++ b/src/mame/drivers/tasc.cpp
@@ -36,6 +36,7 @@ notes:
 TODO:
 - bootrom disable timer shouldn't be needed, real ARM has already fetched the next opcode
 - sound is too high pitched, same problem as in risc2500
+- "disable leds" setting breaks smartboard controls
 
 ******************************************************************************/
 
diff --git a/src/mame/machine/smartboard.cpp b/src/mame/machine/smartboard.cpp
index 72a0978da94..4288f28044e 100644
--- a/src/mame/machine/smartboard.cpp
+++ b/src/mame/machine/smartboard.cpp
@@ -225,16 +225,21 @@ uint8_t tasc_sb30_device::spawn_cb(offs_t offset)
 
 uint8_t tasc_sb30_device::read()
 {
-	int x = (m_position & 0x3f) / 8;
-	int y = (m_position & 0x3f) % 8;
-	int piece_id = m_board->read_sensor(7 - x, 7 - y);
+	if (m_position < 0x40)
+	{
+		int x = 7 - m_position / 8;
+		int y = 7 - m_position % 8;
+		int piece_id = m_board->read_sensor(x, y);
 
-	// each piece is identified by a single bit in a 32-bit sequence, if multiple bits are active the MSB is used
-	uint32_t sb30_id = 0;
-	if (piece_id > 0)
-		sb30_id = 1UL << (piece_id - 1);
+		// each piece is identified by a single bit in a 32-bit sequence, if multiple bits are active the MSB is used
+		uint32_t sb30_id = 0;
+		if (piece_id > 0)
+			sb30_id = 1UL << (piece_id - 1);
 
-	return BIT(sb30_id, m_shift & 0x1f);
+		return BIT(sb30_id, m_shift & 0x1f);
+	}
+
+	return 0;
 }
 
 void tasc_sb30_device::write(uint8_t data)
@@ -244,15 +249,18 @@ void tasc_sb30_device::write(uint8_t data)
 
 	if (BIT(data, 6) && !BIT(m_data, 6))
 	{
-		int x = (m_position & 0x3f) / 8;
-		int y = (m_position & 0x3f) % 8;
-		m_out_leds[y][x] = BIT(data, 7);
+		if (m_position < 0x40)
+		{
+			int x = m_position / 8;
+			int y = m_position % 8;
+			m_out_leds[y][x] = BIT(data, 7);
+		}
 	}
 
 	if (!BIT(data, 7) && BIT(m_data, 7))
 	{
 		m_position++;
-		if (m_position & 0x40)
+		if (m_position >= 0x40)
 		{
 			m_shift++;
 			if (m_position & 1)
diff --git a/src/mame/machine/smartboard.h b/src/mame/machine/smartboard.h
index 4eefb86e5bf..c56adda84e7 100644
--- a/src/mame/machine/smartboard.h
+++ b/src/mame/machine/smartboard.h
@@ -47,7 +47,7 @@ private:
 	output_finder<8,8>        m_out_leds;
 	emu_timer *               m_leds_off_timer;
 	uint8_t                   m_data;
-	uint8_t                   m_position;
+	uint32_t                  m_position;
 	uint8_t                   m_shift;
 };