Sprinter/mame
2
0
Fork 0
mirror of https://github.com/holub/mame synced 2025-04-20 15:32:45 +03:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

divtlb.cpp: remove a crash caused by the modulus operator

Browse Source 
In the original code all values are signed integers, so m_dynindex would
overflow and become negative, then the modulus of a negative value by a
positive one would generate a negative result and finally the next array
read would make the program crash.
Also the maximum value plus one of m_dynindex is not generally a
multiple of m_dynamic and this would cause a jump in the values of
liveindex.
This commit is contained in:
yz70s 2021-08-14 18:35:42 +02:00
parent 57ddc51b52
commit 855c9d4087
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/emu/divtlb.cpp
View File

@ -177,8 +177,9 @@ bool device_vtlb_interface::vtlb_fill(offs_t address, int intention)
// if this is the first successful translation for this address, allocate a new entry
if ((entry & VTLB_FLAGS_MASK) == 0)
{
int liveindex = m_dynindex++ % m_dynamic;
int liveindex = m_dynindex;
m_dynindex = (m_dynindex + 1) % m_dynamic;
// if an entry already exists at this index, free it
if (m_live[liveindex] != 0)
@ -277,7 +278,10 @@ void device_vtlb_interface::vtlb_dynload(u32 index, offs_t address, vtlb_entry v
return;
}
int liveindex = m_dynindex++ % m_dynamic;
int liveindex = m_dynindex;
m_dynindex = (m_dynindex + 1) % m_dynamic;
// is entry already live?
if (!(entry & VTLB_FLAG_VALID))
{