From 3d5f818095f69ab36cb5843954588cacebcb8565 Mon Sep 17 00:00:00 2001 From: "Unknown W. Brackets" Date: Sun, 2 Jun 2013 11:40:12 -0700 Subject: [PATCH] Add a bounds check to writeVideoImageWithRange(). Fixes crash in Jeanne d' Arc, which sends 480x480. --- Core/HW/MediaEngine.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Core/HW/MediaEngine.cpp b/Core/HW/MediaEngine.cpp index 56d15d7087..d32b186689 100644 --- a/Core/HW/MediaEngine.cpp +++ b/Core/HW/MediaEngine.cpp @@ -447,6 +447,11 @@ bool MediaEngine::writeVideoImageWithRange(u8* buffer, int frameWidth, int video u16 *imgbuf16 = (u16 *)buffer; u16 *data16 = (u16 *)data; + if (width > m_desWidth - xpos) + width = m_desWidth - xpos; + if (height > m_desHeight - ypos) + height = m_desHeight - ypos; + switch (videoPixelMode) { case TPSM_PIXEL_STORAGE_MODE_32BIT_ABGR8888: data += (ypos * m_desWidth + xpos) * sizeof(u32);