From ab028c9d80363fa61f2b7b77c22ad66f93303671 Mon Sep 17 00:00:00 2001
From: Jeffrey Pfau <jeffrey@endrift.com>
Date: Wed, 3 Jun 2015 20:41:47 -0700
Subject: [PATCH] GBA: Add more savestate checks

---
 src/gba/serialize.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/gba/serialize.c b/src/gba/serialize.c
index 8ffe12d29..7c6ce214e 100644
--- a/src/gba/serialize.c
+++ b/src/gba/serialize.c
@@ -78,6 +78,10 @@ void GBADeserialize(struct GBA* gba, const struct GBASerializedState* state) {
 		GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: CPU cycles are negative");
 		return;
 	}
+	if (state->video.eventDiff < 0) {
+		GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: video eventDiff is negative");
+		return;
+	}
 	if (state->video.nextHblank - state->video.eventDiff < 0) {
 		GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: nextHblank is negative");
 		return;
@@ -86,6 +90,10 @@ void GBADeserialize(struct GBA* gba, const struct GBASerializedState* state) {
 		GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: overflowInterval is negative");
 		return;
 	}
+	if (state->audio.eventDiff < 0) {
+		GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: audio eventDiff is negative");
+		return;
+	}
 	if (state->audio.ch1.envelopeNextStep < 0 || state->audio.ch1.waveNextStep < 0 || state->audio.ch1.sweepNextStep < 0 || state->audio.ch1.nextEvent < 0) {
 		GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: audio channel 1 register is negative");
 		return;