From 171c237c8fe78819da16332ff415293e1918bdb3 Mon Sep 17 00:00:00 2001
From: FeralChild64 <you@example.com>
Date: Tue, 24 Dec 2019 22:09:08 +0100
Subject: [PATCH] added protection against too long file header

---
 c64/aliases/,aliases_ram_lowmem.s      |  2 +-
 c64/kernal/tape/load_tape_normal.s     |  4 +++-
 c64/kernal/tape/tape_normal_get_data.s | 20 ++++++++++++++------
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/c64/aliases/,aliases_ram_lowmem.s b/c64/aliases/,aliases_ram_lowmem.s
index 62f76618..8f522b21 100644
--- a/c64/aliases/,aliases_ram_lowmem.s
+++ b/c64/aliases/,aliases_ram_lowmem.s
@@ -89,7 +89,7 @@
 	.label C3PO      = $94  //          flag - is BSOUR content valid
 	.label BSOUR     = $95  //          serial bus buffered output byte
 	.label SYNO      = $96  //          -- NOT IMPLEMENTED --
-	.label XSAV      = $97  //          temporary register storage for ASCII related routines [!] usage details might differ
+	.label XSAV      = $97  //          temporary register storage for ASCII/tape related routines [!] usage details might differ
 	.label LDTND     = $98  //          number of entries in LAT / FAT / SAT tables
 	.label DFLTN     = $99  //          default input device
 	.label DFLTO     = $9A  //          default output device
diff --git a/c64/kernal/tape/load_tape_normal.s b/c64/kernal/tape/load_tape_normal.s
index c5159b8b..f67ed8a4 100644
--- a/c64/kernal/tape/load_tape_normal.s
+++ b/c64/kernal/tape/load_tape_normal.s
@@ -81,7 +81,8 @@ load_tape_normal_header:
 	// Retrieve the header
 
 	jsr tape_normal_pilot_header
-	jsr tape_normal_get_data           // XXX limit it to 192 bytes
+	ldy #$C1                           // size limit (including checksum)
+	jsr tape_normal_get_data
 	bcs load_tape_normal_header        // unable to read block, try again
 
 	// Check header type
@@ -121,6 +122,7 @@ load_tape_normal_payload:
 	// Retrieve data
 
 	jsr tape_normal_pilot_data
+	ldy #$00                           // no data size limit
 	jsr tape_normal_get_data
 	bcs_far tape_load_error
 
diff --git a/c64/kernal/tape/tape_normal_get_data.s b/c64/kernal/tape/tape_normal_get_data.s
index 7c7acb14..21972deb 100644
--- a/c64/kernal/tape/tape_normal_get_data.s
+++ b/c64/kernal/tape/tape_normal_get_data.s
@@ -3,7 +3,7 @@
 // Tape (normal) helper routine - data block reading
 //
 // Stores data starting from MEMUSS, Carry set means error, on 0 bit .A is 0 too
-//
+// .Y not equal to 0 - returns error if data block is longer (length includes checksum)
 
 
 // XXX improve error handling - do not ignore second copy, handle damaged sync part
@@ -14,16 +14,17 @@
 
 tape_normal_get_data:
 
+	// Store block size limit
+	sty XSAV
+
 	// Initialize checksum (RIPRTY, see http://sta.c64.org/cbm64mem.html)
-	
 	lda #$00
 	sta RIPRTY
 
 	// Read the pilot and sync of the block
-
 	ldy #$89
 	jsr tape_normal_sync
-	bcs tape_normal_get_block_done     // XXX make it more erroor resistant
+	bcs tape_normal_get_block_done     // XXX make it more error resistant
 	jsr tape_normal_get_marker
 
 tape_normal_get_data_loop:
@@ -35,7 +36,7 @@ tape_normal_get_data_loop:
 
 	// Store byte, calculate checksum
 	lda INBIT
-	ldy #$00                           // XXX probably can be optimized for 65C02
+	ldy #$00                           // XXX probably can be optimized out for 65C02
 	sta (MEMUSS), y
 	eor RIPRTY
 	sta RIPRTY
@@ -47,7 +48,14 @@ tape_normal_get_data_loop:
 	inw MEMUSS+0
 #endif
 
-	jmp tape_normal_get_data_loop
+	// Check block length limit
+	lda XSAV
+	beq tape_normal_get_data_loop      // no limit requested
+	dec XSAV
+	bne tape_normal_get_data_loop
+
+	sec
+	rts
 
 tape_normal_get_checksum: // XXX handle second copy, with pilot starting from $09