From 3809876179ec1201155c2101b73dacf57599beed Mon Sep 17 00:00:00 2001
From: Vicki Pfau <vi@endrift.com>
Date: Sun, 2 May 2021 22:43:26 -0700
Subject: [PATCH] GBA: Fix some patch loading edge cases

---
 CHANGES       | 1 +
 src/gba/gba.c | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index fe0225e4a..b1dec75e7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,7 @@ Emulation fixes:
  - GBA Video: Revert scanline latching changes (fixes mgba.io/i/2153, mgba.io/i/2149)
 Other fixes:
  - Core: Fix memory leak in opening games from the library
+ - GBA: Fix out of bounds ROM accesses on patched ROMs smaller than 32 MiB
  - Qt: Fix infrequent deadlock when using sync to video
  - Qt: Fix applying savetype-only overrides
  - Util: Fix loading UPS patches that affect the last byte of the file
diff --git a/src/gba/gba.c b/src/gba/gba.c
index 7e9d3d47a..d8a4b740a 100644
--- a/src/gba/gba.c
+++ b/src/gba/gba.c
@@ -501,7 +501,11 @@ void GBAApplyPatch(struct GBA* gba, struct Patch* patch) {
 	}
 	if (gba->romVf) {
 #ifndef FIXED_ROM_BUFFER
-		gba->romVf->unmap(gba->romVf, gba->memory.rom, gba->pristineRomSize);
+		if (!gba->isPristine) {
+			mappedMemoryFree(gba->memory.rom, SIZE_CART0);
+		} else {
+			gba->romVf->unmap(gba->romVf, gba->memory.rom, gba->pristineRomSize);
+		}
 #endif
 		gba->romVf->close(gba->romVf);
 		gba->romVf = NULL;
@@ -510,7 +514,7 @@ void GBAApplyPatch(struct GBA* gba, struct Patch* patch) {
 	gba->memory.rom = newRom;
 	gba->memory.hw.gpioBase = &((uint16_t*) gba->memory.rom)[GPIO_REG_DATA >> 1];
 	gba->memory.romSize = patchedSize;
-	gba->memory.romMask = SIZE_CART0 - 1;
+	gba->memory.romMask = toPow2(patchedSize) - 1;
 	gba->romCrc32 = doCrc32(gba->memory.rom, gba->memory.romSize);
 }