GBA: More savestate sanitization
Jeffrey Pfau jeffrey@endrift.com
Sat, 03 Oct 2015 21:33:31 -0700
1 files changed,
11 insertions(+),
0 deletions(-)
jump to
M
src/gba/serialize.c
→
src/gba/serialize.c
@@ -99,6 +99,17 @@ if (state->video.nextHblank - state->video.eventDiff < 0) {
GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: nextHblank is negative"); error = true; } + if (state->video.nextEvent < state->cpu.cycles) { + uint16_t dispstat = state->io[REG_DISPSTAT >> 1]; + if (GBARegisterDISPSTATIsInHblank(dispstat) && state->video.eventDiff + state->cpu.cycles > state->video.nextHblank) { + GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: nextHblank will be negative"); + error = true; + } + if (!GBARegisterDISPSTATIsInHblank(dispstat) && state->video.eventDiff + state->cpu.cycles > state->video.lastHblank + VIDEO_HBLANK_LENGTH) { + GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: nextHblank will be negative"); + error = true; + } + } if (state->timers[0].overflowInterval < 0 || state->timers[1].overflowInterval < 0 || state->timers[2].overflowInterval < 0 || state->timers[3].overflowInterval < 0) { GBALog(gba, GBA_LOG_WARN, "Savestate is corrupted: overflowInterval is negative"); error = true;