Skip to content

Commit

Permalink
SNES: Fixed heap corruption if ROM isn't the expected size
Browse files Browse the repository at this point in the history
I'm sure there are other side effects that I'm missing, but for now it no longer destroys the allocation table.
  • Loading branch information
ducalex committed Jul 23, 2024
1 parent a5cc490 commit cd322a1
Showing 1 changed file with 3 additions and 4 deletions.
7 changes: 3 additions & 4 deletions retro-core/components/snes9x/memmap.c
Original file line number Diff line number Diff line change
Expand Up @@ -352,7 +352,7 @@ bool LoadROM(const char* filename)
bool Tales = false;
FILE *fp;

printf("Loading ROM: '%s'\n", filename ? filename : "(null)");
printf("Loading ROM: '%s'\n", filename ?: "(Memory.ROM)");

Memory.ExtendedFormat = NOPE;

Expand All @@ -365,7 +365,6 @@ bool LoadROM(const char* filename)
again:
if (filename == NULL)
{
printf("Using Memory.ROM as is.\n");
TotalFileSize = Memory.ROM_Size;
}
else if ((fp = fopen(filename, "rb")))
Expand Down Expand Up @@ -471,7 +470,8 @@ bool LoadROM(const char* filename)
}

Memory.CalculatedSize = TotalFileSize & ~0x1FFF; /* round down to lower 0x2000 */
memset(Memory.ROM + Memory.CalculatedSize, 0, MAX_ROM_SIZE - Memory.CalculatedSize);
if (Memory.ROM_Size > Memory.CalculatedSize)
memset(Memory.ROM + Memory.CalculatedSize, 0, Memory.ROM_Size - Memory.CalculatedSize);

if (Memory.CalculatedSize > 0x400000 &&
!(Memory.ROM[0x7FD5] == 0x32 && ((Memory.ROM[0x7FD6] & 0xF0) == 0x40)) && /* exclude S-DD1 */
Expand Down Expand Up @@ -638,7 +638,6 @@ bool LoadROM(const char* filename)
}
Memory.LoROM = true;
Memory.HiROM = false;
memset(&Memory.ROM[Memory.CalculatedSize], 0, MAX_ROM_SIZE - Memory.CalculatedSize);
}
}

Expand Down

0 comments on commit cd322a1

Please sign in to comment.