From f1fd4ae6961eb20b05c61fb934b67c14c9c3a102 Mon Sep 17 00:00:00 2001
From: Sjoerd van der Berg <harekiet@users.sourceforge.net>
Date: Sun, 22 Dec 2002 13:13:51 +0000
Subject: [PATCH] Fix for memory allocate to not run outside the range of xms
 handles.

Imported-from: https://svn.code.sf.net/p/dosbox/code-0/dosbox/trunk@590
---
 src/ints/xms.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/ints/xms.cpp b/src/ints/xms.cpp
index d369d350..875baa2f 100644
--- a/src/ints/xms.cpp
+++ b/src/ints/xms.cpp
@@ -118,7 +118,8 @@ Bitu XMS_Handler(void) {
 	case XMS_LOCAL_ENABLE_A20:									/* 05 */
 	case XMS_LOCAL_DISABLE_A20:									/* 06 */
 	case XMS_QUERY_A20:											/* 07 */
-		LOG_WARN("XMS:Unhandled call %2X",reg_ah);break;	
+		LOG_WARN("XMS:Unhandled call %2X",reg_ah);
+		break;	
 	case XMS_QUERY_FREE_EXTENDED_MEMORY:						/* 08 */
 		/* Scan the tree for free memory and find largest free block */
 		{ 
@@ -177,7 +178,7 @@ foundnew:
 					return CBRET_NONE;
 				}	
 				/* Not a free block or too small advance to next one if possible */
-				if (xms_handles[index].next) index=xms_handles[index].next;
+				if (xms_handles[index].next < XMS_HANDLES ) index=xms_handles[index].next;
 				else break;
 			}
 			/* Found no good blocks give some errors */
@@ -311,7 +312,7 @@ foundnew:
 		}
 		reg_bh=xms_handles[reg_dx].locked;
 		/* Find available blocks */
-		reg_bx=0;{ for (Bitu i=0;i<XMS_HANDLES;i++) if (!xms_handles[i].data) reg_bx++;}
+		reg_bx=0;{ for (Bitu i=1;i<XMS_HANDLES;i++) if (!xms_handles[i].data) reg_bx++;}
 		reg_dx=xms_handles[reg_dx].size;
 		break;
 	case XMS_RESIZE_EXTENDED_MEMORY_BLOCK:						/* 0f */