80486DX2-66/86Box-fork
1
0
Fork 0
Code Issues Pull Requests Activity

Fixed a potentially crash-causing bug in io_removehandler().

Browse Source
This commit is contained in:
OBattler
2020-05-18 05:23:13 +02:00
parent d5114bdf67
commit ed511e10fc
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/io.c
View File

@@ -154,13 +154,14 @@ io_removehandler(uint16_t base, int size,
void *priv) void *priv)
{ {
int c; int c;
io_t *p; io_t *p, *q;
for (c = 0; c < size; c++) { for (c = 0; c < size; c++) {
p = io[base + c]; p = io[base + c];
if (!p) if (!p)
continue; continue;
while(p) { while(p) {
q = p->next;
if ((p->inb == inb) && (p->inw == inw) && if ((p->inb == inb) && (p->inw == inw) &&
(p->inl == inl) && (p->outb == outb) && (p->inl == inl) && (p->outb == outb) &&
(p->outw == outw) && (p->outl == outl) && (p->outw == outw) && (p->outl == outl) &&
@@ -177,7 +178,7 @@ io_removehandler(uint16_t base, int size,
p = NULL; p = NULL;
break; break;
} }
p = p->next; p = q;
} }
} }
} }
@@ -251,7 +252,7 @@ io_removehandler_interleaved(uint16_t base, int size,
void *priv) void *priv)
{ {
int c; int c;
io_t *p; io_t *p, *q;
size <<= 2; size <<= 2;
for (c = 0; c < size; c += 2) { for (c = 0; c < size; c += 2) {
@@ -259,6 +260,7 @@ io_removehandler_interleaved(uint16_t base, int size,
if (!p) if (!p)
return; return;
while(p) { while(p) {
q = p->next;
if ((p->inb == inb) && (p->inw == inw) && if ((p->inb == inb) && (p->inw == inw) &&
(p->inl == inl) && (p->outb == outb) && (p->inl == inl) && (p->outb == outb) &&
(p->outw == outw) && (p->outl == outl) && (p->outw == outw) && (p->outl == outl) &&
@@ -270,7 +272,7 @@ io_removehandler_interleaved(uint16_t base, int size,
free(p); free(p);
break; break;
} }
p = p->next; p = q;
} }
} }
} }