ioports.c change -> buffer overflow ... bug?

[Marcus Meissner]

Hi Florian,

You are calling get_timer_val(3) in ioports.c 
(if (chan == 3) ... going down to get_timer_val(chan))

Howver, tmr_8253 is just a 3 element array, so [3] will run over the end,

Is your code right? The change comes from this commit:

commit edbd4885542e4545439906df950a68dc48e70839
    Author: Florian Tobias Schandinat 
    Date:   Tue Feb 3 18:26:04 2009 +0100

winedos: Improve PIT emulation.

Ciao, Marcus

[Florian Tobias Schandinat]

Marcus Meissner schrieb:
> Hi Florian,
>
> You are calling get_timer_val(3) in ioports.c 
> (if (chan == 3) ... going down to get_timer_val(chan))
>
> Howver, tmr_8253 is just a 3 element array, so [3] will run over the end,
>
> Is your code right? The change comes from this commit:
>
> commit edbd4885542e4545439906df950a68dc48e70839
>    Author: Florian Tobias Schandinat 
>    Date:   Tue Feb 3 18:26:04 2009 +0100
>    winedos: Improve PIT emulation.
>
> Ciao, Marcus

Sorry, I forgot to adjust the calls in readback case where the channel 
information is stored in different bits. Thanks for reporting, the 
attached patch should fix it.

Greetings,

Florian Tobias Schandinat