Fixed the third batch of problems.

src/floppy/fdc.c

@@ -994,6 +994,7 @@ fdc_write(uint16_t addr, uint8_t val, void *priv)
 					case 0x16:	/* Verify */
 						if (fdc->params[0] & 0x80)
 							fdc->sc = fdc->params[7];
+						/*FALLTHROUGH*/
 					case 0x06:	/* Read data */
 					case 0x0c:	/* Read deleted data */
 						fdc_io_command_phase1(fdc, 0);

src/floppy/fdd.c

@@ -491,7 +491,8 @@ fdd_load(int drive, wchar_t *fn)
     f = plat_fopen(fn, L"rb");
     if (!f)
 	return;
-    fseek(f, -1, SEEK_END);
+    if (fseek(f, -1, SEEK_END) == -1)
+	fatal("fdd_load(): Error seeking to the end of the file\n");
     size = ftell(f) + 1;
     fclose(f);        
     while (loaders[c].ext) {

src/floppy/fdd_86f.c

@@ -1174,15 +1174,8 @@ d86f_put_bit(int drive, int side, int bit)
     if (d86f_has_surface_desc(drive)) {
 	surface_bit = (surface_data >> track_bit) & 1;
 	if (! surface_bit) {
-		if (! current_bit) {
-			/* Bit is 0 and is not set to fuzzy, we overwrite it as is. */
-			dev->last_word[side] |= bit;
-			current_bit = bit;
-		} else {
-			/* Bit is 1 and is not set to fuzzy, we overwrite it as is. */
-			dev->last_word[side] |= bit;
-			current_bit = bit;
-		}
+		dev->last_word[side] |= bit;
+		current_bit = bit;
 	} else {
 		if (current_bit) {
 			/* Bit is 1 and is set to fuzzy, we overwrite it with a non-fuzzy bit. */
@@ -2949,10 +2942,13 @@ d86f_read_track(int drive, int track, int thin_track, int side, uint16_t *da, ui
 
     if (dev->track_offset[logical_track]) {
 	if (! thin_track) {
-		fseek(dev->f, dev->track_offset[logical_track], SEEK_SET);
-		fread(&(dev->side_flags[side]), 2, 1, dev->f);
+		if (fseek(dev->f, dev->track_offset[logical_track], SEEK_SET) == -1)
+			fatal("d86f_read_track(): Error seeking to offset dev->track_offset[logical_track]\n");
+		if (fread(&(dev->side_flags[side]), 1, 2, dev->f) != 2)
+			fatal("d86f_read_track(): Error reading side flags\n");
 		if (d86f_has_extra_bit_cells(drive)) {
-			fread(&(dev->extra_bit_cells[side]), 4, 1, dev->f);
+			if (fread(&(dev->extra_bit_cells[side]), 1, 4, dev->f) != 4)
+				fatal("d86f_read_track(): Error reading number of extra bit cells\n");
 			/* If RPM shift is 0% and direction is 1, do not adjust extra bit cells,
 			   as that is the whole track length. */
 			if (d86f_get_rpm_mode(drive) || !d86f_get_speed_shift_dir(drive)) {
@@ -3146,7 +3142,8 @@ d86f_write_tracks(int drive, FILE **f, uint32_t *track_table)
 		}
 
 		if (tbl[logical_track]) {
-			fseek(*f, tbl[logical_track], SEEK_SET);
+			if (fseek(*f, tbl[logical_track], SEEK_SET) == -1)
+				fatal("d86f_write_tracks(): Error seeking to offset tbl[logical_track]\n");
 			d86f_write_track(drive, f, side, d86f_handler[drive].encoded_data(drive, side), dev->track_surface_data[side]);
 		}
 	}

src/floppy/fdd_fdi.c

@@ -331,7 +331,6 @@ fdi_load(int drive, wchar_t *fn)
     dev = (fdi_t *)malloc(sizeof(fdi_t));
     memset(dev, 0x00, sizeof(fdi_t));
 
-    dev->f = plat_fopen(fn, L"rb");
     if (dev == NULL) {
 	free(dev);
 	memset(floppyfns[drive], 0, sizeof(floppyfns[drive]));
@@ -340,8 +339,11 @@ fdi_load(int drive, wchar_t *fn)
 
     d86f_unregister(drive);
 
-    fread(header, 1, 25, dev->f);
-    fseek(dev->f, 0, SEEK_SET);
+    dev->f = plat_fopen(fn, L"rb");
+    if (fread(header, 1, 25, dev->f) != 25)
+	fatal("fdi_load(): Error reading header\n");
+    if (fseek(dev->f, 0, SEEK_SET) == -1)
+	fatal("fdi_load(): Error seeking to the beginning of the file\n");
     header[25] = 0;
     if (strcmp(header, "Formatted Disk Image file") != 0) {
 	/* This is a Japanese FDI file. */

src/floppy/fdd_imd.c

@@ -629,6 +629,7 @@ imd_load(int drive, wchar_t *fn)
 	dev->f = plat_fopen(fn, L"rb");
 	if (dev->f == NULL) {
 		memset(floppyfns[drive], 0, sizeof(floppyfns[drive]));
+		free(dev);
 		return;
 	}
 	writeprot[drive] = 1;
@@ -654,6 +655,13 @@ imd_load(int drive, wchar_t *fn)
     if (fseek(dev->f, 0, SEEK_END) == -1)
 	fatal("imd_load(): Error seeking to the end of the file\n");
     fsize = ftell(dev->f);
+    if (fsize <= 0) {
+	imd_log("IMD: Too small ImageDisk image\n");
+	fclose(dev->f);
+	free(dev);
+	memset(floppyfns[drive], 0, sizeof(floppyfns[drive]));
+	return;
+    }
     if (fseek(dev->f, 0, SEEK_SET) == -1)
 	fatal("imd_load(): Error seeking to the beginning of the file again\n");
     dev->buffer = malloc(fsize);
@@ -661,7 +669,7 @@ imd_load(int drive, wchar_t *fn)
 	fatal("imd_load(): Error reading data\n");
     buffer = dev->buffer;
 
-    buffer2 = strchr(buffer, 0x1A);
+    buffer2 = memchr(buffer, 0x1A, fsize);
     if (buffer2 == NULL) {
 	imd_log("IMD: No ASCII EOF character\n");
 	fclose(dev->f);

src/floppy/fdd_mfm.c

@@ -358,8 +358,9 @@ mfm_read_side(int drive, int side)
 	else
 		ret = fseek(dev->f, dev->tracks[track_index].track_offset, SEEK_SET);
 	if (ret == -1)
-		fatal("MFM: Error seeking in mfm_read_side()\n");
-	fread(dev->track_data[side], 1, track_bytes, dev->f);
+		fatal("mfm_read_side(): Error seeking to the beginning of the file\n");
+	if (fread(dev->track_data[side], 1, track_bytes, dev->f) != track_bytes)
+		fatal("mfm_read_side(): Error reading track bytes\n");
     }
 
     mfm_log("drive = %i, side = %i, dev->cur_track = %i, track_index = %i, track_size = %i\n",

src/floppy/fdd_td0.c

@@ -231,8 +231,10 @@ fdd_image_read(int drive, char *buffer, uint32_t offset, uint32_t len)
 {
     td0_t *dev = td0[drive];
 
-    fseek(dev->f, offset, SEEK_SET);
-    fread(buffer, 1, len, dev->f);
+    if (fseek(dev->f, offset, SEEK_SET) == -1)
+	fatal("fdd_image_read(): Error seeking to the beginning of the file\n");
+    if (fread(buffer, 1, len, dev->f) != len)
+	fatal("fdd_image_read(): Error reading data\n");
 }
 
 

src/floppy/fdi2raw.c

@@ -2039,9 +2039,12 @@ FDI *fdi2raw_header(FILE *f)
 		fdi_free(fdi);
 		return NULL;
 	}
-	fseek (fdi->file, 0, SEEK_SET);
-	fread (fdi->header, 2048, 1, fdi->file);
-	fseek (fdi->file, oldseek, SEEK_SET);
+	if (fseek (fdi->file, 0, SEEK_SET) == -1)
+		fatal("fdi2raw_header(): Error seeking to the beginning of the file\n");
+	if (fread (fdi->header, 1, 2048, fdi->file) != 2048)
+		fatal("fdi2raw_header(): Error reading header\n");
+	if (fseek (fdi->file, oldseek, SEEK_SET) == -1)
+		fatal("fdi2raw_header(): Error seeking to offset oldseek\n");
 	if (memcmp (fdiid, fdi->header, strlen ((char *)fdiid)) ) {
 		fdi_free(fdi);
 		return NULL;