From 7735c08fd5075862c57e353063ad59e84d8b9d60 Mon Sep 17 00:00:00 2001
From: Jeffrey Pfau <jeffrey@endrift.com>
Date: Tue, 10 Nov 2015 22:44:23 -0800
Subject: [PATCH] GBA Memory: Fix unaligned out-of-bounds ROM loads

---
 CHANGES          | 1 +
 src/gba/memory.c | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 8b3fa78c1..7accca33f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -23,6 +23,7 @@ Bugfixes:
  - GBA Memory: Fix Store8 to OBJ VRAM
  - GBA Memory: Fix alignment of LDM/STM on SRAM
  - GBA: Initialize uninitialized pristineRom and pristineRomSize members
+ - GBA Memory: Fix unaligned out-of-bounds ROM loads
 Misc:
  - Qt: Window size command line options are now supported
  - Qt: Increase usability of key mapper
diff --git a/src/gba/memory.c b/src/gba/memory.c
index 14a203d58..7f673dd5e 100644
--- a/src/gba/memory.c
+++ b/src/gba/memory.c
@@ -364,8 +364,8 @@ static void GBASetActiveRegion(struct ARMCore* cpu, uint32_t address) {
 		LOAD_32(value, address & (SIZE_CART0 - 4), memory->rom); \
 	} else { \
 		GBALog(gba, GBA_LOG_GAME_ERROR, "Out of bounds ROM Load32: 0x%08X", address); \
-		value = (address >> 1) & 0xFFFF; \
-		value |= ((address + 2) >> 1) << 16; \
+		value = ((address & ~3) >> 1) & 0xFFFF; \
+		value |= (((address & ~3) + 2) >> 1) << 16; \
 	}
 
 #define LOAD_SRAM \