ref: 366da3c3d266b56bcd22ea5c4b586597f648aee4
parent: b559b93eeb0aa4fb01713b5af89e567096a1c43b
author: Snesrev <snesrev@protonmail.com>
date: Wed Mar 8 17:29:59 EST 2023
The previous fix for #174 was buggy
--- a/player.c
+++ b/player.c
@@ -3556,7 +3556,8 @@
} else {
static const uint8 kLiftTab0[10] = { 8, 24, 8, 24, 8, 32, 6, 8, 13, 13 };
static const uint8 kLiftTab1[10] = { 0, 1, 0, 1, 0, 1, 0, 1, 2, 3 };
- static const uint8 kLiftTab2[] = { 6, 7, 7, 5 };
+ static const uint8 kLiftTab2[29] = { 6, 7, 7, 5, 10, 0, 23, 0, 18, 0, 18, 0, 8, 0, 8, 0, 254, 255, 17, 0,
+ 0x54, 0x52, 0x50, 0xFF, 0x51, 0x53, 0x55, 0x56, 0x57 };
if (player_handler_timer != 0) {
if (player_handler_timer + 1 != 9) {
@@ -3576,7 +3577,7 @@
}
} else {
// fix OOB read triggered when lifting for too long
- if (some_animation_timer_steps >= 3)
+ if (some_animation_timer_steps >= sizeof(kLiftTab2) - 1)
return;
some_animation_timer = kLiftTab2[++some_animation_timer_steps];
assert(some_animation_timer_steps < arraysize(kLiftTab2));
--- a/snes/cpu.c
+++ b/snes/cpu.c
@@ -741,7 +741,7 @@
uint32_t addr = (cpu->k << 16) | cpu->pc;
switch (addr - 1) {
case 0x7B269: // Link_APress_LiftCarryThrow reads OOB
- if ((cpu->x & 0xff) >= 3)
+ if ((cpu->x & 0xff) >= 28)
cpu->pc = 0xB280; // RTS
opcode = 0xE8;
goto RESTART;