Changeset 100518 in vbox for trunk/src/VBox

Timestamp:

Jul 11, 2023 2:56:03 PM (17 months ago)

Author:

vboxsync

Message:

VUSB: Additional paranoia to clear USB buffers used by the guest (see bugref:10438).

File:

• trunk/src/VBox/Devices/USB/VUSBUrb.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/USB/VUSBUrb.cpp

@@ -678 +678 @@
     }
 
+    /* Paranoia: Clear data memory that was previously used
+     * by the guest. See @bugref{10438}.
+     */
+    PVUSBSETUP pOldSetup = pExtra->pMsg;
+    uint32_t   cbClean = sizeof(VUSBSETUP) + pOldSetup->wLength;
+    cbClean = RT_MIN(cbClean, pExtra->cbMax);
+    memset(pExtra->Urb.abData, 0, cbClean);
+
     /*
      * Check if we've got an cancelled message URB. Allocate a new one in that case.
@@ -705 +713 @@
     {
         uint32_t cbReq = RT_ALIGN_32(cbBuf + pSetupIn->wLength, 64);
-        PVUSBCTRLEXTRA pNew = (PVUSBCTRLEXTRA)RTMemRealloc(pExtra, RT_UOFFSETOF_DYN(VUSBCTRLEXTRA, Urb.abData[cbReq]));
+        PVUSBCTRLEXTRA pNew = (PVUSBCTRLEXTRA)RTMemReallocZ(pExtra,
+                                                            RT_UOFFSETOF_DYN(VUSBCTRLEXTRA, Urb.abData[pExtra->cbMax]),
+                                                            RT_UOFFSETOF_DYN(VUSBCTRLEXTRA, Urb.abData[cbReq]));
         if (!pNew)
         {