# HG changeset patch # User Michael Pavone # Date 1709502479 28800 # Node ID aaf7bb58ffcacf84585014733362194fdaccb157 # Parent a634985b1df3c4ff54c2d58a525aa95c759fb9b5 Fix bug in Gen/MD serialize routine that could cause a use-after free in some cases diff -r a634985b1df3 -r aaf7bb58ffca genesis.c --- a/genesis.c Sat Mar 02 15:33:14 2024 -0800 +++ b/genesis.c Sun Mar 03 13:47:59 2024 -0800 @@ -139,13 +139,19 @@ genesis_context *gen = (genesis_context *)sys; uint32_t address; if (gen->m68k->resume_pc) { - gen->m68k->target_cycle = gen->m68k->current_cycle; + gen->header.save_state = SERIALIZE_SLOT+1; - resume_68k(gen->m68k); + while (!gen->serialize_tmp) + { + gen->m68k->target_cycle = gen->m68k->current_cycle + 1; + resume_68k(gen->m68k); + } if (size_out) { *size_out = gen->serialize_size; } - return gen->serialize_tmp; + uint8_t *ret = gen->serialize_tmp; + gen->serialize_tmp = NULL; + return ret; } else { serialize_buffer state; init_serialize(&state);