Fix another statefile overflow

diff --git a/custom.cpp b/custom.cpp
index 1043efbaf8894d4f112a1c3870e29861b092bcb8..d72b090966ca0f484c8b73e75e5ae6a0c1de1713 100644 (file)
--- a/custom.cpp
+++ b/custom.cpp
@@ -7724,7 +7724,7 @@ uae_u8 *save_custom(size_t *len, uae_u8 *dstptr, int full)
        if (dstptr) {
                dstbak = dst = dstptr;
        } else {
-               dstbak = dst = xmalloc(uae_u8, 8 + 256 * 2);
+               dstbak = dst = xmalloc(uae_u8, 4 + 256 * 2 + 4);
        }
 
        SL(currprefs.chipset_mask | 0x100);
@@ -7966,7 +7966,7 @@ uae_u8 *save_custom_sprite(int num, size_t *len, uae_u8 *dstptr)
        if (dstptr)
                dstbak = dst = dstptr;
        else
-               dstbak = dst = xmalloc(uae_u8, 30);
+               dstbak = dst = xmalloc(uae_u8, 100);
        SL(s->pt);              /* 120-13E SPRxPT */
        SW(s->pos);             /* 1x0 SPRxPOS */
        SW(s->ctl);             /* 1x2 SPRxPOS */

diff --git a/drawing.cpp b/drawing.cpp
index 8ea6e497c205cb2e721061e61ab9d41c51a64605..4b625b93074442d4ed2f9093ae6f1793c0f2b889 100644 (file)
--- a/drawing.cpp
+++ b/drawing.cpp
@@ -2276,7 +2276,7 @@ static void spr_arms(struct denise_spr *s, int state)
 {
        // ECS Denise + superhires: sprites 4 to 7 are disabled
        if (ecs_denise_only && denise_res == RES_SUPERHIRES) {
-               int num = s - dspr;
+               size_t num = s - dspr;
                if (num >= 4) {
                        state = 0;
                }
@@ -5821,7 +5821,7 @@ uae_u8 *save_custom_bpl(size_t *len, uae_u8 *dstptr)
        if (dstptr)
                dstbak = dst = dstptr;
        else
-               dstbak = dst = xmalloc(uae_u8, 30);
+               dstbak = dst = xmalloc(uae_u8, 8 * 64);
 
        SL(1);
        for (int i = 0; i < 8; i++) {