These are false-positive findings, but they touch flimsy part of code,
that could very easily break.
In all 4 cases the code looked like this:
uint8_t buf[MEM_PAGE_SIZE]; // old lines 600, 601
…
if (region.bytes > MEM_PAGE_SIZE)
toread = MEM_PAGE_SIZE; // old line 635
else
toread = region.bytes;
// assert toread <= MEM_PAGE_SIZE
if (toread < remain) {
MEM_BlockWrite(…, buf, toread);
} else {
MEM_BlockWrite(…, buf, remain);
MEM_BlockWrite(…, &buf[remain], toread - remain);
// ~~~~~~~~~~~~
// ^
// Coverity flags buffer overrun here
// when: toread == remain == MEM_PAGE_SIZE
// because buf has size MEM_PAGE_SIZE
//
// Sometimes it's MEM_BlockRead, but the problem is the same
}
In such cases, second MEM_BlockWrite is a no-op because
(toread - remain == 0), but Coverity did not reach this point in
analysis (Coverity is right to check the corner case, but didn't know,
that we can assert toread <= MEM_PAGE_SIZE, so the corner case is the
only value triggering this buffer overrun).
Change `if (toread < remain)` to `if (toread <= remain)`, so corner case
will never trigger second (no-op) MEM_BlockRead/Write inside `else`.
This property can be used for selecting which display dosbox should
initially use. Number 0 can be either primary display or left-most
display, depending on OS and user settings.
AUTOTYPE performs scripted keyboard entry into the running
DOS program.
It can be used to reliably skip intros, answer Q&A style questions
that some games ask on startup, or conduct a simple demo.
It allows for delaying input by any number of fractional seconds,
as well defining the pacing between keystrokes. It uses the
comma character "," to insert additional delays similar to modern
phone numbers.
It uses key_* names as defined by the mapper to avoid using SDL
scancodes[1], which are unstable across platforms. This approach
also allows the triggering of custom key bindings the use has
defined.
[1] https://wiki.libsdl.org/SDL_GetScancodeName
"Warning: The returned name is by design not stable across
platforms, e.g. the name for SDL_SCANCODE_LGUI is "Left GUI" under
Linux but "Left Windows" under Microsoft Windows, and some
scancodes like SDL_SCANCODE_NONUSBACKSLASH don't have any name at
all. There are even scancodes that share names, e.g.
SDL_SCANCODE_RETURN and SDL_SCANCODE_RETURN2 (both called
"Return"). This function is therefore unsuitable for creating a
stable cross-platform two-way mapping between strings and
scancodes."
In the previous code, if the game attempted to seek beyond the track
length, or if a "seek & read" would add up to going beyond the
end-of-the-track, the code would pass those requests to the underlying
codecs to handle (and reject with a corresponding error code).
This PR moves those checks up into the CDROM CD-DA code, and will
short-circuit them. Illegal seeks won't be attempted, however the usual
negative return code will still be passed to the game just like before.
Likewise, reads beyond the end will be pruned so they will get as much
audio as possible, without asking the codec for extra.
Rules are defined for all C/C++ code, except src/libs.
These rules are designed to emulate kernel coding convention with some
adaptations for C++11. Configuration file uses options available in
clang-format 8.0 (the newest version in 10.0) to provide compatibility
with older environments and operating systems. Some options are
commented out and marked with TODOs - those need to be investigated and
enabled/disabled during upgrade to clang-format 9.0.
DOSBox codebase is a mix of various styles with only few consistent
rules seen throughout the codebase, these clang-format rules preserve
some of existing conventions and conciously break with others.
Some unwritten upstream rules, that are now encoded in clang-format:
- Using tab for indentation.
- K&R-like indentation for control statements.
- Indentation rules for structs, classes, and non-anonymous enums.
- Case labels in switch statements are aligned the same way goto
statements would be (also K&R rule).
Some formatting aspects that were not followed consistently throughout
old DOSBox code, but are now encoded in clang-format:
- Space placing in control statements and function calls (makes the code
much more readable).
- Control statements (if-else, while) must be broken into multiple lines
(makes the code more readable, helps with debugging, reading compiler
logs and static analysis reports).
Some unwritten upstream rules, that are now changed by these rules:
- Placing opening function bracket in the same line as function
declaration (not in line with K&R). This rule makes it hard to make
constructor formatting consistent - old code dealt with it by not
formatting initializer lists at all. Unformatted initializer list can
result in lines hundreds of lines long and make it hard to add/remove
class fields while assuring correct initialization order.
In new clang-format rules K&R indentation is followed, allowing
initalizer lists to be formatted one initializer per line (which makes
it much easier to read and edit.
This fixes mouse visibility issues on the Raspberry Pi,
which uses an older customized version of SDL2. SDL2 on
the Pi fires different windows events in a different
order, making dealing with states challenging.
To handle this generically, we additionally assess the
mouse capture state after the Window has gained focus.
We also add a "has_focus" state tracking boolean to the
SDL object, which protects against general SDL mouse
trigger events from changing the mouse state before the
Window has "risen" and delivered us an EXPOSED or FOCUS
event. In the prior code rapidly clicking the mouse while
DOSBox was starting could freeze the mouse cursor in
place on the Pi.
We still also assess the mouse state on EXPOSE events,
which is fired after full - windowed modes are toggled.
The EXPOSE even occurs reliably on OSX, X11, Wayland, and
Windows after the window has settled (but is never fired
on the Pi).
Upstream replaced C++11 code with C++ "almost-equivalents", when merging
code from MAME project.
Reverting this fixes few warnings (comparison of signed and unsigned
integer in this case) and makes it slightly easier for the compiler
to unroll the nested loops.
vsync is an option introduced by SDL2 patch, but the testing indicates,
that it very rarely (if ever) works. We still want to support it, but
this might require serious implementation effort, so for the time being
we're removing broken option to prevent confusing the users.
This allows us to show a warning to the user if the .conf file includes
a property that is no longer supported, or a property that is completely
unknown. Actual handling of the property can still be implemented
(e.g. to use as a fallback for modern replacement), but doesn't need
to be.
It's the easiest way to prevent problems when user wants to play the
game using fullscreen while explicitly setting tiny resolution
for a specific game (e.g. 320x200).
All rendering backends except output=surface assume input buffer row
with the same length as output buffer row. Surface is "special" and in
fullscreen uses pitch equal to *screen* width instead. Padding the
output rows with black pixels is necessary for splash screen to show up
correctly.
