From 97bf951b0faddd32d619f52c0e8043e7919678b3 Mon Sep 17 00:00:00 2001
From: dinkc64 <12570148+dinkc64@users.noreply.github.com>
Date: Fri, 2 Jan 2015 06:19:59 +0000
Subject: [PATCH] sanity checking for YMZ280BROM[SIZE]

---
 src/burn/drv/cave/d_dodonpachi.cpp  |  3 ++-
 src/burn/drv/cave/d_esprade.cpp     |  3 ++-
 src/burn/drv/cave/d_feversos.cpp    |  3 ++-
 src/burn/drv/cave/d_gaia.cpp        |  2 +-
 src/burn/drv/cave/d_guwange.cpp     |  3 ++-
 src/burn/drv/cave/d_korokoro.cpp    |  2 ++
 src/burn/drv/cave/d_uopoko.cpp      |  3 ++-
 src/burn/drv/toaplan/d_bbakraid.cpp |  3 ++-
 src/burn/snd/ymz280b.cpp            | 22 +++++++++++++++++-----
 src/burn/snd/ymz280b.h              |  1 +
 10 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/src/burn/drv/cave/d_dodonpachi.cpp b/src/burn/drv/cave/d_dodonpachi.cpp
index 5222ffda9..584fa0380 100644
--- a/src/burn/drv/cave/d_dodonpachi.cpp
+++ b/src/burn/drv/cave/d_dodonpachi.cpp
@@ -460,7 +460,8 @@ static INT32 LoadRoms()
 	// Load YMZ280B data
 	BurnLoadRom(YMZ280BROM + 0x000000, 9, 1);
 	BurnLoadRom(YMZ280BROM + 0x200000, 10, 1);
-	
+	YMZ280BROMSIZE = 0x400000;
+
 	BurnLoadRom(DefaultEEPROM, 11, 1);
 
 	return 0;
diff --git a/src/burn/drv/cave/d_esprade.cpp b/src/burn/drv/cave/d_esprade.cpp
index 958949a5d..6aa1adce5 100644
--- a/src/burn/drv/cave/d_esprade.cpp
+++ b/src/burn/drv/cave/d_esprade.cpp
@@ -492,7 +492,8 @@ static INT32 LoadRoms()
 
 	// Load YMZ280B data
 	BurnLoadRom(YMZ280BROM, 11, 1);
-	
+	YMZ280BROMSIZE = 0x400000;
+
 	BurnLoadRom(DefaultEEPROM, 12, 1);
 
 	return 0;
diff --git a/src/burn/drv/cave/d_feversos.cpp b/src/burn/drv/cave/d_feversos.cpp
index 3c6026198..aff71c975 100644
--- a/src/burn/drv/cave/d_feversos.cpp
+++ b/src/burn/drv/cave/d_feversos.cpp
@@ -446,7 +446,8 @@ static INT32 LoadRoms()
 	NibbleSwap2(CaveTileROM[1], 0x200000);
 
 	BurnLoadRom(YMZ280BROM, 6, 1);
-	
+	YMZ280BROMSIZE = 0x400000;
+
 	BurnLoadRom(DefaultEEPROM, 7, 1);
 
 	return 0;
diff --git a/src/burn/drv/cave/d_gaia.cpp b/src/burn/drv/cave/d_gaia.cpp
index b23ab54ce..a74888207 100644
--- a/src/burn/drv/cave/d_gaia.cpp
+++ b/src/burn/drv/cave/d_gaia.cpp
@@ -674,7 +674,7 @@ static INT32 LoadRoms()
 	BurnLoadRom(YMZ280BROM + 0x000000, 7, 1);
 	BurnLoadRom(YMZ280BROM + 0x400000, 8, 1);
 	BurnLoadRom(YMZ280BROM + 0x800000, 9, 1);
-
+	YMZ280BROMSIZE = 0xc00000;
 	return 0;
 }
 
diff --git a/src/burn/drv/cave/d_guwange.cpp b/src/burn/drv/cave/d_guwange.cpp
index 4c2883f5b..53164a112 100644
--- a/src/burn/drv/cave/d_guwange.cpp
+++ b/src/burn/drv/cave/d_guwange.cpp
@@ -504,7 +504,8 @@ static INT32 LoadRoms()
 
 	// Load YMZ280B data
 	BurnLoadRom(YMZ280BROM, 9, 1);
-	
+	YMZ280BROMSIZE = 0x400000;
+
 	BurnLoadRom(DefaultEEPROM, 14, 1);
 
 	return 0;
diff --git a/src/burn/drv/cave/d_korokoro.cpp b/src/burn/drv/cave/d_korokoro.cpp
index 42a470778..cf61c547f 100644
--- a/src/burn/drv/cave/d_korokoro.cpp
+++ b/src/burn/drv/cave/d_korokoro.cpp
@@ -533,6 +533,7 @@ static INT32 LoadRoms()
 
 	// Load YMZ280B data
 	BurnLoadRom(YMZ280BROM, 4, 1);
+	YMZ280BROMSIZE = 0x100000;
 
 	return 0;
 }
@@ -613,6 +614,7 @@ static INT32 crushermLoadRoms()
 	// Load YMZ280B data
 	BurnLoadRom(YMZ280BROM + 0x000000, 4, 1);
 	BurnLoadRom(YMZ280BROM + 0x100000, 5, 1);
+	YMZ280BROMSIZE = 0x200000;
 
 	return 0;
 }
diff --git a/src/burn/drv/cave/d_uopoko.cpp b/src/burn/drv/cave/d_uopoko.cpp
index 1360b5124..c88843c0d 100644
--- a/src/burn/drv/cave/d_uopoko.cpp
+++ b/src/burn/drv/cave/d_uopoko.cpp
@@ -441,7 +441,8 @@ static INT32 LoadRoms()
 
 	// Load YMZ280B data
 	BurnLoadRom(YMZ280BROM, 4, 1);
-	
+	YMZ280BROMSIZE = 0x200000;
+
 	BurnLoadRom(DefaultEEPROM, 5, 1);
 
 	return 0;
diff --git a/src/burn/drv/toaplan/d_bbakraid.cpp b/src/burn/drv/toaplan/d_bbakraid.cpp
index ef4eddf18..5e8c5a78f 100644
--- a/src/burn/drv/toaplan/d_bbakraid.cpp
+++ b/src/burn/drv/toaplan/d_bbakraid.cpp
@@ -431,7 +431,8 @@ static INT32 LoadRoms()
 	BurnLoadRom(YMZ280BROM + 0x000000, 9, 1);
 	BurnLoadRom(YMZ280BROM + 0x400000, 10, 1);
 	BurnLoadRom(YMZ280BROM + 0x800000, 11, 1);
-	
+	YMZ280BROMSIZE = 0xc00000;
+
 	BurnLoadRom(DefaultEEPROM, 12, 1);
 	
 	return 0;
diff --git a/src/burn/snd/ymz280b.cpp b/src/burn/snd/ymz280b.cpp
index d2d61755a..202e0d1a4 100644
--- a/src/burn/snd/ymz280b.cpp
+++ b/src/burn/snd/ymz280b.cpp
@@ -8,6 +8,7 @@ static INT32 nYMZ280BSampleRate;
 bool bESPRaDeMixerKludge = false;
 
 UINT8* YMZ280BROM;
+UINT32 YMZ280BROMSIZE = 0xffffff; // 16meg max addressable rom size
 void (*pYMZ280BRAMWrite)(INT32 offset, INT32 nValue) = NULL;
 INT32 (*pYMZ280BRAMRead)(INT32 offset) = NULL;
 
@@ -192,6 +193,7 @@ void YMZ280BExit()
 	pYMZ280BRAMWrite = NULL;
 	pYMZ280BRAMRead = NULL;
 	bESPRaDeMixerKludge = false;
+	YMZ280BROMSIZE = 0xffffff;
 
 	DebugSnd_YMZ280BInitted = 0;
 }
@@ -253,10 +255,20 @@ inline static void RampChannel()
 #endif
 }
 
+UINT8 ymz280b_read_memory(UINT32 offset)
+{
+	if (offset < YMZ280BROMSIZE) {
+		return YMZ280BROM[offset];
+	} else {
+		bprintf(0, _T("ymz280b bad offset: %d!! (max. size: %d)\n"), offset, YMZ280BROMSIZE);
+		return 0;
+	}
+}
+
 inline static void decode_adpcm()
 {
 	// Get next value & compute delta
-	nDelta = YMZ280BROM[channelInfo->nPosition >> 1];
+	nDelta = ymz280b_read_memory(channelInfo->nPosition >> 1);
 	if (channelInfo->nPosition & 1) {
 		nDelta &= 0x0F;
 	} else {
@@ -287,7 +299,7 @@ inline static void decode_adpcm()
 
 inline static void decode_pcm8()
 {
-	nDelta = YMZ280BROM[channelInfo->nPosition >> 1];
+	nDelta = ymz280b_read_memory(channelInfo->nPosition >> 1);
 
 	channelInfo->nSample = (INT8)nDelta * 256;
 	channelInfo->nPosition+=2;
@@ -295,7 +307,7 @@ inline static void decode_pcm8()
 
 inline static void decode_pcm16()
 {
-	nDelta = (INT16)((YMZ280BROM[channelInfo->nPosition / 2 + 1] << 8) + YMZ280BROM[channelInfo->nPosition / 2]);
+	nDelta = (INT16)((ymz280b_read_memory(channelInfo->nPosition / 2 + 1) << 8) + ymz280b_read_memory(channelInfo->nPosition / 2));
 
 	channelInfo->nSample = nDelta;
 	channelInfo->nPosition+=4;
@@ -382,7 +394,7 @@ inline static void RenderADPCMLoop_Linear()
 
 			do {
 				// Check for end of sample
-				if (channelInfo->nPosition == channelInfo->nLoopStop) {
+				if (channelInfo->nPosition >= channelInfo->nLoopStop) {
 					channelInfo->nStep = channelInfo->nLoopStep;
 					channelInfo->nSample = channelInfo->nLoopSample;
 					channelInfo->nPosition = channelInfo->nLoopStart;
@@ -569,7 +581,7 @@ void YMZ280BWriteRegister(UINT8 nValue)
 
 						if (YMZ280BChannelInfo[nWriteChannel].nMode > 1) {
 #ifdef DEBUG
-		//					bprintf(0,_T("Sample Start: %08X - Stop: %08X.\n"),YMZ280BChannelInfo[nWriteChannel].nSampleStart, YMZ280BChannelInfo[nWriteChannel].nSampleStop);
+							//bprintf(0,_T("Sample Start: %08X - Stop: %08X.\n"),YMZ280BChannelInfo[nWriteChannel].nSampleStart, YMZ280BChannelInfo[nWriteChannel].nSampleStop);
 #endif
 						}
 
diff --git a/src/burn/snd/ymz280b.h b/src/burn/snd/ymz280b.h
index 8c632c5b3..59af1c796 100644
--- a/src/burn/snd/ymz280b.h
+++ b/src/burn/snd/ymz280b.h
@@ -11,6 +11,7 @@ UINT32 YMZ280BReadStatus();
 UINT32 YMZ280BReadRAM();
 
 extern UINT8* YMZ280BROM;
+extern UINT32 YMZ280BROMSIZE;
 extern bool bESPRaDeMixerKludge;
 
 // external memory handlers