Sprinter/mame
2
0
Fork 0
mirror of https://github.com/holub/mame synced 2025-04-24 09:20:02 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

dbox: fix crash, array out of bounds access (nw)

Browse Source
This commit is contained in:
hap 2020-06-15 21:55:09 +02:00
parent dc54ba1576
commit 946a7f4d5e
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/devices/machine/intelfsh.cpp
View File

@ -87,7 +87,7 @@ DEFINE_DEVICE_TYPE(AMD_29F040, amd_29f040_device, "amd_29f
DEFINE_DEVICE_TYPE(AMD_29F080, amd_29f080_device, "amd_29f080", "AMD 29F080 Flash")
DEFINE_DEVICE_TYPE(AMD_29F400T, amd_29f400t_device, "amd_29f400t", "AMD 29F400T Flash")
DEFINE_DEVICE_TYPE(AMD_29F800T, amd_29f800t_device, "amd_29f800t", "AMD 29F800T Flash")
DEFINE_DEVICE_TYPE(AMD_29F800B_16BIT, amd_29f800b_16bit_device, "amd_29f800b_16bit", "AMD 29F800B Flash used in 16 bit mode")
DEFINE_DEVICE_TYPE(AMD_29F800B_16BIT, amd_29f800b_16bit_device, "amd_29f800b_16bit", "AMD 29F800B Flash (16-bit)")
DEFINE_DEVICE_TYPE(AMD_29LV200T, amd_29lv200t_device, "amd_29lv200t", "AMD 29LV200T Flash")
DEFINE_DEVICE_TYPE(FUJITSU_29F160TE, fujitsu_29f160te_device, "mbm29f160te", "Fujitsu MBM29F160TE Flash")
DEFINE_DEVICE_TYPE(FUJITSU_29F016A, fujitsu_29f016a_device, "mbm29f016a", "Fujitsu MBM29F016A Flash")

12
src/mame/drivers/dbox.cpp
View File

@ -479,7 +479,7 @@ void dbox_state::machine_start()
#if LOCALFLASH
save_pointer (NAME (m_sysflash), sizeof(m_sysflash));
m_sysflash = (uint16_t*)(memregion ("flash")->base());
m_sysflash = (uint16_t*)(memregion ("flash0")->base());
m_sf_mode = 0;
m_sf_state = 0;
#endif
@ -580,10 +580,11 @@ void dbox_state::dbox_map(address_map &map)
// 008004ee Address mask CS0 00000040, 003ffff5 (ffffffff) - Mask: 003fff00 FCM:0f DD:1 PS: 16-Bit
// 008004f8 Base address CS0 00000044, 0000005b (ffffffff) - Base: 00000000 BFC:05 WP:1 FTE:0 NCS:1 Valid: Yes
#if LOCALFLASH
map(0x000000, 0x3fffff).rom().r(FUNC(dbox_state::sysflash_r)).region("flash", 0);
map(0x000000, 0x3fffff).rom().r(FUNC(dbox_state::sysflash_r)).region("flash0", 0);
map(0x000000, 0x3fffff).w(FUNC(dbox_state::sysflash_w));
#else
map(0x000000, 0x3fffff).rw("flash", FUNC(intelfsh16_device::read), FUNC(intelfsh16_device::write));
map(0x000000, 0x0fffff).rw("flash0", FUNC(intelfsh16_device::read), FUNC(intelfsh16_device::write));
map(0x100000, 0x1fffff).rw("flash1", FUNC(intelfsh16_device::read), FUNC(intelfsh16_device::write));
#endif
// CS2 - CS demux
// 0000009a Address mask CS2 00000050, 00007fff (ffffffff) - Mask: 00007f00 FCM:0f DD:3 PS: External DSACK response
@ -625,7 +626,8 @@ void dbox_state::dbox(machine_config &config)
modem.rxd_handler().set("maincpu:serial", FUNC(mc68340_serial_module_device::rx_b_w));
/* Add the boot flash */
AMD_29F800B_16BIT(config, "flash");
AMD_29F800B_16BIT(config, "flash0");
AMD_29F800B_16BIT(config, "flash1");
/* LED Matrix Display */
SDA5708(config, m_display, 0);
@ -643,7 +645,7 @@ void dbox_state::init_dbox()
// TODO: Figure out correct ROM address map
// TODO: Figure out what DVB2000 is doing
ROM_START( dbox )
ROM_REGION16_BE(0x400000, "flash", ROMREGION_ERASEFF)
ROM_REGION16_BE(0x400000, "flash0", ROMREGION_ERASEFF) // should be 0x100000
ROM_DEFAULT_BIOS("b200uns")
ROM_SYSTEM_BIOS(0, "b200uns", "Nokia Bootloader B200uns")