M CHANGES → CHANGES

@@ -33,6 +33,7 @@ - Qt: Fix open ROM dialog filtering for archive formats
  - ARM7: Fix Thumb MUL timing
  - Qt: Cap the maximum number of multiplayer windows
  - Qt: Fix maximum year in sensor override
+ - GBA: Cap audio FIFO read size during deserialization
 Misc:
  - Qt: Handle saving input settings better
  - Debugger: Free watchpoints in addition to breakpoints

M src/gba/audio.c → src/gba/audio.c

@@ -904,8 +904,12 @@ audio->nextCh4 = state->audio.ch4.nextEvent;
 
 	CircleBufferClear(&audio->chA.fifo);
 	CircleBufferClear(&audio->chB.fifo);
-	int i;
-	for (i = 0; i < state->audio.fifoSize; ++i) {
+	size_t fifoSize = state->audio.fifoSize;
+	if (state->audio.fifoSize > CircleBufferCapacity(&audio->chA.fifo)) {
+		fifoSize = CircleBufferCapacity(&audio->chA.fifo);
+	}
+	size_t i;
+	for (i = 0; i < fifoSize; ++i) {
 		CircleBufferWrite8(&audio->chA.fifo, state->audio.fifoA[i]);
 		CircleBufferWrite8(&audio->chB.fifo, state->audio.fifoB[i]);
 	}

M src/gba/serialize.h → src/gba/serialize.h

@@ -231,7 +231,7 @@ uint8_t fifoB[32];
 		int32_t nextEvent;
 		int32_t eventDiff;
 		int32_t nextSample;
-		int32_t fifoSize;
+		uint32_t fifoSize;
 		unsigned ch1Volume : 4;
 		unsigned ch1Dead : 1;
 		unsigned ch1Hi : 1;