fix mupen buffer overflow checks; fix pure interpreter

resolves #4095
TASEmulators · Oct 18, 2024 · d3f4c1f · d3f4c1f
1 parent 542f917
commit d3f4c1f
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/Assets/dll/mupen64plus.dll b/Assets/dll/mupen64plus.dll
diff --git a/libmupen64plus/mupen64plus-core/src/memory/dma.c b/libmupen64plus/mupen64plus-core/src/memory/dma.c
@@ -235,7 +235,7 @@ void dma_pi_write(void)
         for (i=0; i<(int)longueur; i++)
         {
             ((unsigned char*)rdram)[MASK_ADDR_U8((pi_register.pi_dram_addr_reg+i)^S8, rdram)]=
-                rom[MASK_ADDR_U8((((pi_register.pi_cart_addr_reg-0x10000000)&0x3FFFFFF)+i)^S8, rom)];
+                rom[((((pi_register.pi_cart_addr_reg-0x10000000)&0x3FFFFFF)+i)^S8) & (rom_size - 1)];
         }
     }
 
@@ -300,7 +300,7 @@ void dma_sp_write(void)
 
     for(j=0; j<count; j++) {
         for(i=0; i<length; i++) {
-            spmem[MASK_ADDR_U8(memaddr^S8, SP_DMEM)] = dram[MASK_ADDR_U8(dramaddr^S8, rdram)];
+            spmem[(memaddr^S8) & 0xFFF] = dram[MASK_ADDR_U8(dramaddr^S8, rdram)];
             memaddr++;
             dramaddr++;
         }
@@ -326,7 +326,7 @@ void dma_sp_read(void)
 
     for(j=0; j<count; j++) {
         for(i=0; i<length; i++) {
-            dram[MASK_ADDR_U8(dramaddr^S8, rdram)] = spmem[MASK_ADDR_U8(memaddr^S8, SP_DMEM)];
+            dram[MASK_ADDR_U8(dramaddr^S8, rdram)] = spmem[(memaddr^S8) & 0xFFF];
             memaddr++;
             dramaddr++;
         }

diff --git a/libmupen64plus/mupen64plus-core/src/memory/flashram.c b/libmupen64plus/mupen64plus-core/src/memory/flashram.c
@@ -187,7 +187,7 @@ void dma_read_flashram(void)
         for (i=0; i<(pi_register.pi_wr_len_reg & 0x0FFFFFF)+1; i++)
         {
             ((unsigned char*)rdram)[MASK_ADDR_U8((pi_register.pi_dram_addr_reg+i)^S8, rdram)]=
-                flashram[MASK_ADDR_U8((((pi_register.pi_cart_addr_reg-0x08000000)&0xFFFF)*2+i)^S8, rdram)];
+                flashram[MASK_ADDR_U8((((pi_register.pi_cart_addr_reg-0x08000000)&0xFFFF)*2+i)^S8, flashram)];
         }
         break;
     default: