From 725b0ee6ab96067fdb3d22cc7b231b2894c85138 Mon Sep 17 00:00:00 2001
From: kichikuou <KichikuouChrome@gmail.com>
Date: Sun, 14 Jun 2020 22:09:14 +0900
Subject: [PATCH] Prevent buffer overrun by DF command

---
 src/cmdd.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/cmdd.c b/src/cmdd.c
index 23dc620..5913219 100644
--- a/src/cmdd.c
+++ b/src/cmdd.c
@@ -76,11 +76,21 @@ void commandDR() {
 
 void commandDF() {
 	int *data_var = getCaliVariable();
+	int varno     = preVarNo;
 	int cnt       = getCaliValue();
 	int data      = getCaliValue();
 	
 	DEBUG_COMMAND("DF %p,%d,%d:\n", data_var, cnt, data);
 
+	const arrayVarStruct* array = &sysVarAttribute[varno];
+	if (array->page) {
+		int maxlen = arrayVarBuffer[array->page - 1].max - array->offset - *array->pointvar;
+		if (cnt > maxlen) {
+			WARNING("%03d:%05x: count exceeds array boundary (%d > %d)\n", sl_getPage(), sl_getIndex(), cnt, maxlen);
+			cnt = maxlen;
+		}
+	}
+
 	while (cnt--) {
 		*data_var = data; data_var++;
 	}