ZipGS CDA bug

["Charlie" <charlied@bboard.com>]

Hi,

I was recently looking through the Apple II FAQs that Rubywand posted and I
realized I might have some information about the ZipGS.

Its been quite a while since I discovered a potentially disastrous bug in
the ZipGS CDA V1.2, but here it is:

On exiting the CDA, a routine is called that is $FD bytes from the beginning
of the code (when loaded into the machine). This code looks something like
this:

Exit LDA Flag
  BEQ NOZIP
  JSR ANOTHER.ROUTINE   ;See below
NOZIP  JSR ...........
        JSR ...........
  LDA STACK
  TCS
* a lot of TextTool calls in here.
  PLB
END  RTL

* Lots of code between the routine above and the one below.
ANOTHER.ROUTINE
  JSR ...........
  JSR YET.ANOTHER.ROUTINE  ;see below
  RTS

YET.ANOTHER.ROUTINE
  SEP %00110000
  JSR .........
  LDA VAL0
  STAL $00C059
  LDA VAL2
  STAL $00C05C
  LDA SPEED
  CMP #$00
  BEQ :1
  SEC
  LDA #$10
  SBC SPEED
  ASL
  ASL
  ASL
  ASL
  STAL $00C05D
  STAL $00C05B
  BRA :2
:1  STA $C05D ;This a mistake!!! It should it be STAL $00C05D.
  JSR .........
:2  JSR .........
  REP %00110000
  RTS

If you trace through the code you will see that there is a short STA
instruction (no bank byte in operand) where there should be a long STA (bank
byte in operand).

As it stands, if the ZipGS is disabled (speed is zero) when you exit the CDA
the routine writes a byte (00) to location $C05D in whatever bank the CDA is
located instead of bank zero.  This location could be inside another program
(or even the ZipGS CDA) and bad things could happen.
I patched the routine by putting "NOP" in the offending bytes.  This at
least kept it from doing any harm.

Charlie