Skip to content

Commit 676bdb4

Browse files
committed
Fixes double allocation of framebuffer and audio buffer overflow
1 parent b4b5d71 commit 676bdb4

File tree

1 file changed

+27
-28
lines changed

1 file changed

+27
-28
lines changed

FreeDOGameCore.mm

Lines changed: 27 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
11
/*
22
Copyright (c) 2014, OpenEmu Team
33
4-
4+
55
Redistribution and use in source and binary forms, with or without
66
modification, are permitted provided that the following conditions are met:
7-
* Redistributions of source code must retain the above copyright
8-
notice, this list of conditions and the following disclaimer.
9-
* Redistributions in binary form must reproduce the above copyright
10-
notice, this list of conditions and the following disclaimer in the
11-
documentation and/or other materials provided with the distribution.
12-
* Neither the name of the OpenEmu Team nor the
13-
names of its contributors may be used to endorse or promote products
14-
derived from this software without specific prior written permission.
15-
7+
* Redistributions of source code must retain the above copyright
8+
notice, this list of conditions and the following disclaimer.
9+
* Redistributions in binary form must reproduce the above copyright
10+
notice, this list of conditions and the following disclaimer in the
11+
documentation and/or other materials provided with the distribution.
12+
* Neither the name of the OpenEmu Team nor the
13+
names of its contributors may be used to endorse or promote products
14+
derived from this software without specific prior written permission.
15+
1616
THIS SOFTWARE IS PROVIDED BY OpenEmu Team ''AS IS'' AND ANY
1717
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
1818
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
1919
DISCLAIMED. IN NO EVENT SHALL OpenEmu Team BE LIABLE FOR ANY
2020
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
2121
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
22-
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
22+
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
2323
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
2424
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
25-
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25+
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2626
*/
2727

2828
#import "FreeDOGameCore.h"
@@ -53,7 +53,7 @@
5353
#define INPUTBUTTONDOWN (1<<14)
5454

5555
typedef struct{
56-
int buttons; // buttons bitfield
56+
int buttons; // buttons bitfield
5757
}inputState;
5858

5959
inputState internal_input_state[6];
@@ -113,7 +113,7 @@ @implementation FreeDOGameCore
113113
{
114114
current->sampleBuffer[current->sampleCurrent] = (uintptr_t)data;
115115
current->sampleCurrent++;
116-
if(current->sampleCurrent > TEMP_BUFFER_SIZE)
116+
if(current->sampleCurrent >= TEMP_BUFFER_SIZE)
117117
{
118118
current->sampleCurrent = 0;
119119
[[current ringBufferAtIndex:0] write:current->sampleBuffer maxLength:sizeof(int32_t) * TEMP_BUFFER_SIZE];
@@ -170,7 +170,7 @@ @implementation FreeDOGameCore
170170
//[current fdcCallbackArmSync:(intptr_t)data];
171171
NSLog(@"fdcCallback EXT_ARM_SYNC");
172172
break;
173-
173+
174174
default:
175175
break;
176176
}
@@ -459,16 +459,16 @@ - (oneway void)didRelease3DOButton:(OE3DOButton)button forPlayer:(NSUInteger)pla
459459

460460
int CheckDownButton(int deviceNumber,int button)
461461
{
462-
if(internal_input_state[deviceNumber].buttons&button)
462+
if(internal_input_state[deviceNumber].buttons&button)
463463
return 1;
464-
else
464+
else
465465
return 0;
466466
}
467467

468468
char CalculateDeviceLowByte(int deviceNumber)
469469
{
470-
char returnValue = 0;
471-
470+
char returnValue = 0;
471+
472472
returnValue |= 0x01 & 0; // unknown
473473
returnValue |= 0x02 & 0; // unknown
474474
returnValue |= CheckDownButton(deviceNumber, INPUTBUTTONL) ? (char)0x04 : (char)0;
@@ -477,14 +477,14 @@ char CalculateDeviceLowByte(int deviceNumber)
477477
returnValue |= CheckDownButton(deviceNumber, INPUTBUTTONP) ? (char)0x20 : (char)0;
478478
returnValue |= CheckDownButton(deviceNumber, INPUTBUTTONC) ? (char)0x40 : (char)0;
479479
returnValue |= CheckDownButton(deviceNumber, INPUTBUTTONB) ? (char)0x80 : (char)0;
480-
480+
481481
return returnValue;
482482
}
483483

484484
char CalculateDeviceHighByte(int deviceNumber)
485485
{
486-
char returnValue = 0;
487-
486+
char returnValue = 0;
487+
488488
returnValue |= CheckDownButton(deviceNumber, INPUTBUTTONA) ? (char)0x01 : (char)0;
489489
returnValue |= CheckDownButton(deviceNumber, INPUTBUTTONLEFT) ? (char)0x02 : (char)0;
490490
returnValue |= CheckDownButton(deviceNumber, INPUTBUTTONRIGHT) ? (char)0x04 : (char)0;
@@ -493,7 +493,7 @@ char CalculateDeviceHighByte(int deviceNumber)
493493
returnValue |= 0x20 & 0; // unknown
494494
returnValue |= 0x40 & 0; // unknown
495495
returnValue |= 0x80; // This last bit seems to indicate power and/or connectivity.
496-
496+
497497
return returnValue;
498498
}
499499

@@ -541,12 +541,13 @@ - (void)initVideo
541541
{
542542
if(videoBuffer)
543543
free(videoBuffer);
544-
544+
545545
//HightResMode = 1;
546546
videoWidth = 320;
547547
videoHeight = 240;
548548
videoBuffer = (uint32_t*)malloc(videoWidth * videoHeight * 4);
549-
frame = new VDLFrame;
549+
frame = (VDLFrame*)malloc(sizeof(VDLFrame));
550+
memset(frame, 0, sizeof(VDLFrame));
550551
fver2=fver1=0;
551552
}
552553

@@ -555,8 +556,6 @@ - (void)initNVRAM
555556
nvramCopy = malloc(65536/2);
556557
memset(nvramCopy, 0, 65536/2);
557558
memcpy(nvramCopy, nvramhead, sizeof(nvramhead));
558-
frame = (VDLFrame*)malloc(sizeof(VDLFrame));
559-
memset(frame, 0, sizeof(VDLFrame));
560559
}
561560

562561
- (void)loadBIOSes
@@ -567,7 +566,7 @@ - (void)loadBIOSes
567566
assert(len==ROM1_SIZE);
568567
biosRom1Copy = (unsigned char *)malloc(len);
569568
memcpy(biosRom1Copy, [data bytes], len);
570-
569+
571570
// "ROM 2 Japanese Character ROM" / Set it if we find it. It's not requiered for soem JAP games. We still have to init the memory tho
572571
NSString *rom2Path = [[self biosDirectoryPath] stringByAppendingPathComponent:@"rom2.rom"];
573572
data = [NSData dataWithContentsOfFile:rom2Path];

0 commit comments

Comments
 (0)