From f7ad1b74744950de702cb79a8f148780103b1af9 Mon Sep 17 00:00:00 2001
From: AJR <ajrhacker@users.noreply.github.com>
Date: Fri, 8 Sep 2023 23:14:00 -0400
Subject: [PATCH] formats/td0_dsk.cpp: Don't swallow bits and bytes at the end
 of Huffman-encoded images, when the word buffer can no longer be filled

---
 src/lib/formats/td0_dsk.cpp | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/src/lib/formats/td0_dsk.cpp b/src/lib/formats/td0_dsk.cpp
index b54a727bf95..12200754623 100644
--- a/src/lib/formats/td0_dsk.cpp
+++ b/src/lib/formats/td0_dsk.cpp
@@ -90,7 +90,7 @@ private:
 	uint8_t getlen;
 
 	int data_read(uint8_t *buf, uint16_t size);
-	int next_word();
+	int next_word(int needed);
 	int GetBit();
 	int GetByte();
 	void StartHuff();
@@ -412,16 +412,15 @@ static const uint8_t d_len[256] = {
 	0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08,
 };
 
-int td0dsk_t::next_word()
+int td0dsk_t::next_word(int needed)
 {
-	if(tdctl.ibufndx >= tdctl.ibufcnt)
-	{
-		tdctl.ibufndx = 0;
-		tdctl.ibufcnt = data_read(tdctl.inbuf,BUFSZ);
-		if(tdctl.ibufcnt <= 0)
-			return(-1);
-	}
 	while (getlen <= 8) { // typically reads a word at a time
+		if(tdctl.ibufndx >= tdctl.ibufcnt) {
+			tdctl.ibufndx = 0;
+			tdctl.ibufcnt = data_read(tdctl.inbuf,BUFSZ);
+			if(tdctl.ibufcnt <= 0)
+				return(getlen >= needed ? 0 : -1);
+		}
 		getbuf |= tdctl.inbuf[tdctl.ibufndx++] << (8 - getlen);
 		getlen += 8;
 	}
@@ -432,7 +431,7 @@ int td0dsk_t::next_word()
 int td0dsk_t::GetBit()    /* get one bit */
 {
 	int16_t i;
-	if(next_word() < 0)
+	if(next_word(1) < 0)
 		return(-1);
 	i = getbuf;
 	getbuf <<= 1;
@@ -446,7 +445,7 @@ int td0dsk_t::GetBit()    /* get one bit */
 int td0dsk_t::GetByte()    /* get a byte */
 {
 	uint16_t i;
-	if(next_word() != 0)
+	if(next_word(8) != 0)
 		return(-1);
 	i = getbuf;
 	getbuf <<= 8;
@@ -643,7 +642,7 @@ int td0dsk_t::Decode(uint8_t *buf, int len)  /* Decoding/Uncompressing */
 				}
 				else {
 					if((pos = DecodePosition()) < 0)
-							return(count); // fatal error
+						return(count); // fatal error
 					tdctl.bufpos = (tdctl.r - pos - 1) & (N - 1);
 					tdctl.bufcnt = c - 255 + THRESHOLD;
 					tdctl.bufndx = 0;
@@ -1031,7 +1030,9 @@ bool td0_format::load(util::random_read &io, uint32_t form_factor, const std::ve
 		else
 			build_pc_track_mfm(track, head, image, base_cell_count*2, track_spt, sects, calc_default_pc_gap3_size(form_factor, sects[0].actual_size));
 
-		track_spt = offset < actual ? imagebuf[offset] : 255;
+		if(actual <= offset)
+			return false;
+		track_spt = imagebuf[offset];
 	}
 	if((track_count > 50) && (form_factor == floppy_image::FF_525)) // ?
 	{