GBA: Cap audio FIFO read size during deserialization

CHANGES

@@ -33,6 +33,7 @@ Bugfixes:
  - ARM7: Fix Thumb MUL timing
  - Qt: Cap the maximum number of multiplayer windows
  - Qt: Fix maximum year in sensor override
+ - GBA: Cap audio FIFO read size during deserialization
 Misc:
  - Qt: Handle saving input settings better
  - Debugger: Free watchpoints in addition to breakpoints

src/gba/audio.c

@@ -904,8 +904,12 @@ void GBAAudioDeserialize(struct GBAAudio* audio, const struct GBASerializedState
 
 	CircleBufferClear(&audio->chA.fifo);
 	CircleBufferClear(&audio->chB.fifo);
-	int i;
+	size_t fifoSize = state->audio.fifoSize;
-	for (i = 0; i < state->audio.fifoSize; ++i) {
+	if (state->audio.fifoSize > CircleBufferCapacity(&audio->chA.fifo)) {
+		fifoSize = CircleBufferCapacity(&audio->chA.fifo);
+	}
+	size_t i;
+	for (i = 0; i < fifoSize; ++i) {
 		CircleBufferWrite8(&audio->chA.fifo, state->audio.fifoA[i]);
 		CircleBufferWrite8(&audio->chB.fifo, state->audio.fifoB[i]);
 	}

src/gba/serialize.h

@@ -231,7 +231,7 @@ struct GBASerializedState {
 		int32_t nextEvent;
 		int32_t eventDiff;
 		int32_t nextSample;
-		int32_t fifoSize;
+		uint32_t fifoSize;
 		unsigned ch1Volume : 4;
 		unsigned ch1Dead : 1;
 		unsigned ch1Hi : 1;