From 37cb3b81e8fdb0b500a706d1d3b4593b6992cb81 Mon Sep 17 00:00:00 2001
From: Wolfgang Thaller <wolfgang.thaller@gmx.net>
Date: Sun, 29 Sep 2019 21:51:04 +0200
Subject: [PATCH] ConvertDiskImage: fix undefined behavior

---
 ConvertDiskImage/CMakeLists.txt      |  2 ++
 ConvertDiskImage/ConvertDiskImage.cc | 15 +++++++++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/ConvertDiskImage/CMakeLists.txt b/ConvertDiskImage/CMakeLists.txt
index 0665b42f38..2e02da4216 100644
--- a/ConvertDiskImage/CMakeLists.txt
+++ b/ConvertDiskImage/CMakeLists.txt
@@ -1,2 +1,4 @@
 add_executable(ConvertDiskImage ConvertDiskImage.cc)
 target_link_libraries(ConvertDiskImage ResourceFiles)
+
+install(TARGETS ConvertDiskImage RUNTIME DESTINATION bin)
diff --git a/ConvertDiskImage/ConvertDiskImage.cc b/ConvertDiskImage/ConvertDiskImage.cc
index eee9e31469..c48cff2bfb 100644
--- a/ConvertDiskImage/ConvertDiskImage.cc
+++ b/ConvertDiskImage/ConvertDiskImage.cc
@@ -6,7 +6,7 @@
 #include <cassert>
 #include <vector>
 
-void decompreassADC(std::vector<uint8_t>& outbuf, const std::vector<uint8_t>& inbuf)
+void decompressADC(std::vector<uint8_t>& outbuf, const std::vector<uint8_t>& inbuf)
 {
     outbuf.reserve(0x40000);
     auto p = inbuf.begin();
@@ -19,6 +19,7 @@ void decompreassADC(std::vector<uint8_t>& outbuf, const std::vector<uint8_t>& in
             int n = (cmd & 0x7f) + 1;
             outbuf.insert(outbuf.end(), p, p + n);
             p += n;
+            assert(p <= inbuf.end());
         }
         else
         {
@@ -37,8 +38,14 @@ void decompreassADC(std::vector<uint8_t>& outbuf, const std::vector<uint8_t>& in
             }
             ++off;
             
-            outbuf.reserve(outbuf.size() + n);
-            outbuf.insert(outbuf.end(), outbuf.end() - off, outbuf.end() - off + n);
+            assert(n > 0);
+            assert(off > 0);
+            assert(outbuf.size() - off >= 0);
+            outbuf.resize(outbuf.size() + n);
+            auto dst = outbuf.end() - n;
+            auto src = dst - off;
+            while(n--)
+                *dst++ = *src++;
         }
     }
 }
@@ -119,7 +126,7 @@ int main(int argc, char* argv[])
                 break;
             
             case 0x83:
-                decompreassADC(outbuf, inbuf);
+                decompressADC(outbuf, inbuf);
                 break;
         }