From ff788a017c4daeab34156bc0ea30cbd71b6a74b1 Mon Sep 17 00:00:00 2001 From: Jeffrey Pfau Date: Mon, 12 Sep 2016 18:10:28 -0700 Subject: [PATCH] GB Serialize: Check DMA destination when loading state --- src/gb/serialize.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/gb/serialize.c b/src/gb/serialize.c index 53d1210e4..ef61fba19 100644 --- a/src/gb/serialize.c +++ b/src/gb/serialize.c @@ -89,6 +89,7 @@ bool GBDeserialize(struct GB* gb, const struct GBSerializedState* state) { int32_t check; uint32_t ucheck; int16_t check16; + uint16_t ucheck16; LOAD_32LE(ucheck, 0, &state->versionMagic); if (ucheck > GB_SAVESTATE_MAGIC + GB_SAVESTATE_VERSION) { mLOG(GB_STATE, WARN, "Invalid or too new savestate: expected %08X, got %08X", GB_SAVESTATE_MAGIC + GB_SAVESTATE_VERSION, ucheck); @@ -126,11 +127,16 @@ bool GBDeserialize(struct GB* gb, const struct GBSerializedState* state) { mLOG(GB_STATE, WARN, "Savestate is corrupted: video eventDiff is negative"); error = true; } - LOAD_32LE(check16, 0, &state->video.ly); + LOAD_16LE(check16, 0, &state->video.ly); if (check16 < 0 || check16 > GB_VIDEO_VERTICAL_TOTAL_PIXELS) { mLOG(GB_STATE, WARN, "Savestate is corrupted: video y is out of range"); error = true; } + LOAD_16LE(ucheck16, 0, &state->memory.dmaDest); + if (ucheck16 >= GB_SIZE_OAM) { + mLOG(GB_STATE, WARN, "Savestate is corrupted: DMA destination is out of range"); + error = true; + } if (error) { return false; }