Merge pull request #342 from death/bounds-checking

better bounds checking for memcpy, memset

README.md

@@ -8,7 +8,7 @@ Documentation is available in the [wiki](https://github.com/nesbox/tic.computer/
 
 Thanks!
 
-# Building instructions
+# Build instructions
 
 ## Windows
 ### with Visual Studio 2015
@@ -24,6 +24,10 @@ git clone https://github.com/nesbox/TIC-80
 - open `TIC-80\build\windows\tic\tic.sln` and build
 - enjoy :)
 
+### with MinGW32
+follow the instructions in the tutorial https://matheuslessarodrigues.github.io/tic80-build-tutorial/
+made by [@matheuslessarodrigues](https://github.com/matheuslessarodrigues)
+
 ## Linux
 run the following commands in the Terminal
 ```
@@ -32,3 +36,6 @@ git clone https://github.com/nesbox/TIC-80
 cd TIC-80
 make linux32 (or linux64/arm depending on your system)
 ```
+
+## iOS / tvOS
+You can find iOS/tvOS version here https://github.com/CliffsDover/TIC-80

src/jsapi.c

@@ -466,10 +466,9 @@ static duk_ret_t duk_memcpy(duk_context* duk)
 	s32 dest = duk_to_int(duk, 0);
 	s32 src = duk_to_int(duk, 1);
 	s32 size = duk_to_int(duk, 2);
-	s32 dstBound = sizeof(tic_ram) - size;
-	s32 srcBound = sizeof(tic_mem) - size;
+	s32 bound = sizeof(tic_ram) - size;
 
-	if(size > 0 && dest < dstBound && src < srcBound)
+	if(size >= 0 && size <= sizeof(tic_ram) && dest >= 0 && src >= 0 && dest <= bound && src <= bound)
 	{
 		u8* base = (u8*)&getDukMachine(duk)->memory;
 		memcpy(base + dest, base + src, size);
@@ -485,7 +484,7 @@ static duk_ret_t duk_memset(duk_context* duk)
 	s32 size = duk_to_int(duk, 2);
 	s32 bound = sizeof(tic_ram) - size;
 
-	if(size > 0 && dest < bound)
+	if(size >= 0 && size <= sizeof(tic_ram) && dest >= 0 && dest <= bound)
 	{
 		u8* base = (u8*)&getDukMachine(duk)->memory;
 		memset(base + dest, value, size);

src/luaapi.c

@@ -759,14 +759,13 @@ static s32 lua_memcpy(lua_State* lua)
 		s32 dest = getLuaNumber(lua, 1);
 		s32 src = getLuaNumber(lua, 2);
 		s32 size = getLuaNumber(lua, 3);
-		s32 dstBound = sizeof(tic_ram) - size;
-		s32 srcBound = sizeof(tic_mem) - size;
+                s32 bound = sizeof(tic_ram) - size;
 
-		if(dest < dstBound && src < srcBound)
+		if(size >= 0 && size <= sizeof(tic_ram) && dest >= 0 && src >= 0 && dest <= bound && src <= bound)
 		{
 			u8* base = (u8*)&getLuaMachine(lua)->memory;
 			memcpy(base + dest, base + src, size);
-			return 0;	
+			return 0;
 		}
 	}
 
@@ -786,11 +785,11 @@ static s32 lua_memset(lua_State* lua)
 		s32 size = getLuaNumber(lua, 3);
 		s32 bound = sizeof(tic_ram) - size;
 
-		if(dest < bound)
+		if(size >= 0 && size <= sizeof(tic_ram) && dest >= 0 && dest <= bound)
 		{
 			u8* base = (u8*)&getLuaMachine(lua)->memory;
 			memset(base + dest, value, size);
-			return 0;	
+			return 0;
 		}
 	}