@@ -83,6 +83,10 @@ - GBA BIOS: Fix ArcTan2 sign in HLE BIOS (fixes mgba.io/i/689)
  - GBA Video: Don't update background scanline params in mode 0 (fixes mgba.io/i/377)
  - Qt: Ensure CLI backend is attached when submitting commands (fixes mgba.io/i/662)
  - Core: Fix crash with rewind if savestates shrink
+ - Test: Fix crash when loading invalid file
+ - GBA Hardware: Fix crash if a savestate lies about game hardware
+ - Test: Fix crash when fuzzing fails to load a file
+ - GBA: Fix multiboot loading resulting in too small WRAM
 Misc:
  - SDL: Remove scancode key input
  - GBA Video: Clean up unused timers

@@ -76,6 +76,8 @@
 	gba->sio.p = gba;
 	GBASIOInit(&gba->sio);
 
+	GBAHardwareInit(&gba->memory.hw, NULL);
+
 	gba->springIRQ = 0;
 	gba->keySource = 0;
 	gba->rotationSource = 0;
@@ -295,14 +297,9 @@ if (gba->pristineRomSize > SIZE_WORKING_RAM) {
 		gba->pristineRomSize = SIZE_WORKING_RAM;
 	}
 	gba->isPristine = true;
-#ifdef _3DS
-	if (gba->pristineRomSize <= romBufferSize) {
-		gba->memory.wram = romBuffer;
-		vf->read(vf, romBuffer, gba->pristineRomSize);
-	}
-#else
-	gba->memory.wram = vf->map(vf, gba->pristineRomSize, MAP_READ);
-#endif
+	gba->memory.wram = anonymousMemoryMap(SIZE_WORKING_RAM);
+	memset(gba->memory.wram, 0, SIZE_WORKING_RAM);
+	vf->read(vf, gba->memory.wram, gba->pristineRomSize);
 	if (!gba->memory.wram) {
 		mLOG(GBA, WARN, "Couldn't map ROM");
 		return false;

@@ -73,6 +73,9 @@ }
 }
 
 void GBAHardwareGPIOWrite(struct GBACartridgeHardware* hw, uint32_t address, uint16_t value) {
+	if (!hw->gpioBase) {
+		return;
+	}
 	switch (address) {
 	case GPIO_REG_DATA:
 		hw->pinState &= ~hw->direction;

@@ -80,10 +80,11 @@ QMutexLocker lock(&self->m_mutex);
 	while (self->m_lines.isEmpty()) {
 		self->m_cond.wait(&self->m_mutex);
 	}
-	self->m_last = self->m_lines.takeFirst().toUtf8();
-	if (self->m_last.isEmpty()) {
-		self->m_last = "\n";
+	QString last = self->m_lines.takeFirst();
+	if (last.isNull()) {
+		return nullptr;
 	}
+	self->m_last = last.toUtf8();
 	*len = self->m_last.size();
 	return self->m_last.constData();
 
@@ -101,7 +102,7 @@ DebuggerConsoleController* self = consoleBe->self;
 	GameController::Interrupter interrupter(self->m_gameController, true);
 	QMutexLocker lock(&self->m_mutex);
 	if (self->m_history.isEmpty()) {
-		return "\n";
+		return "i";
 	}
 	self->m_last = self->m_history.last().toUtf8();
 	return self->m_last.constData();

@@ -158,6 +158,7 @@ m_screenWidget->setSizeHint(QSize(VIDEO_HORIZONTAL_PIXELS * i, VIDEO_VERTICAL_PIXELS * i));
 #endif
 	m_screenWidget->setPixmap(m_logo);
 	m_screenWidget->setCenteredAspectRatio(m_logo.width(), m_logo.height());
+	m_screenWidget->setLockIntegerScaling(false);
 	setCentralWidget(m_screenWidget);
 
 	connect(m_controller, SIGNAL(gameStarted(mCoreThread*, const QString&)), this, SLOT(gameStarted(mCoreThread*, const QString&)));
@@ -795,6 +796,7 @@ unsigned width, height;
 	context->core->desiredVideoDimensions(context->core, &width, &height);
 	m_display->setMinimumSize(width, height);
 	m_screenWidget->setMinimumSize(m_display->minimumSize());
+	m_config->updateOption("lockIntegerScaling");
 	if (m_savedScale > 0) {
 		resizeFrame(QSize(width, height) * m_savedScale);
 	}
@@ -858,6 +860,7 @@ setWindowFilePath(QString());
 	updateTitle();
 	detachWidget(m_display);
 	m_screenWidget->setCenteredAspectRatio(m_logo.width(), m_logo.height());
+	m_screenWidget->setLockIntegerScaling(false);
 	m_screenWidget->setPixmap(m_logo);
 	m_screenWidget->unsetCursor();
 #ifdef M_CORE_GB
@@ -1342,7 +1345,9 @@ ConfigOption* lockIntegerScaling = m_config->addOption("lockIntegerScaling");
 	lockIntegerScaling->addBoolean(tr("Force integer scaling"), avMenu);
 	lockIntegerScaling->connect([this](const QVariant& value) {
 		m_display->lockIntegerScaling(value.toBool());
-		m_screenWidget->setLockIntegerScaling(value.toBool());
+		if (m_controller->isLoaded()) {
+			m_screenWidget->setLockIntegerScaling(value.toBool());
+		}
 	}, this);
 	m_config->updateOption("lockIntegerScaling");
 

@@ -68,6 +68,9 @@ version(argv[0]);
 		return 0;
 	}
 	struct mCore* core = mCoreFind(args.fname);
+	if (!core) {
+		return 1;
+	}
 	core->init(core);
 	mCoreInitConfig(core, "fuzz");
 	applyArguments(&args, NULL, &core->config);
@@ -91,10 +94,15 @@
 #ifdef __AFL_HAVE_MANUAL_CONTROL
 	__AFL_INIT();
 #endif
+
+	bool cleanExit = true;
+	if (!mCoreLoadFile(core, args.fname)) {
+		cleanExit = false;
+		goto loadError;
+	}
 	if (args.patch) {
 		core->loadPatch(core, VFileOpen(args.patch, O_RDONLY));
 	}
-	mCoreLoadFile(core, args.fname);
 
 	struct VFile* savestate = 0;
 	struct VFile* savestateOverlay = 0;
@@ -155,13 +163,14 @@ if (savestateOverlay) {
 		savestateOverlay->close(savestateOverlay);
 	}
 
+loadError:
 	freeArguments(&args);
 	if (outputBuffer) {
 		free(outputBuffer);
 	}
 	core->deinit(core);
 
-	return 0;
+	return !cleanExit;
 }
 
 static void _fuzzRunloop(struct mCore* core, int frames) {