Changeset 106675 in vbox for trunk/src/VBox/Devices

Timestamp:

Oct 24, 2024 9:37:40 PM (4 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

165539

Message:

Devices/Network: Fix stack overflow on pipe read. bugref:10268

File:

• trunk/src/VBox/Devices/Network/DrvNATlibslirp.cpp (modified) (3 diffs)

trunk/src/VBox/Devices/Network/DrvNATlibslirp.cpp

@@ -775 +775 @@
              * so to avoid false alarm drain pipe here to the very end
              */
-            char ch;
+            char ch[1024];
             size_t cbRead;
             uint64_t cbWakeupNotifs = ASMAtomicReadU64(&pThis->cbWakeupNotifs);
-            RTPipeRead(pThis->hPipeRead, &ch, cbWakeupNotifs, &cbRead);
-            ASMAtomicSubU64(&pThis->cbWakeupNotifs, cbRead);
+
+            if (cbWakeupNotifs > 1024)
+            {
+                RTPipeRead(pThis->hPipeRead, &ch, 1024, &cbRead);
+                ASMAtomicSubU64(&pThis->cbWakeupNotifs, 1024);
+            }
+            else
+            {
+                RTPipeRead(pThis->hPipeRead, &ch, cbWakeupNotifs, &cbRead);
+                ASMAtomicSubU64(&pThis->cbWakeupNotifs, cbRead);
+            }
         }
 
@@ -791 +800 @@
         slirp_pollfds_fill(pThis->pNATState->pSlirp, &msTimeout, drvNAT_AddPollCb /* SlirpAddPollCb */, pThis /* opaque */);
         drvNAT_UpdateTimeout(&msTimeout, pThis);
-
+.h
         int cChangedFDs = WSAPoll(pThis->pNATState->polls, pThis->pNATState->nsock, msTimeout /* timeout */);
         int error = WSAGetLastError();
@@ -808 +817 @@
              * so to avoid false alarm drain pipe here to the very end
              */
-            char ch;
+            char ch[1024];
             size_t cbRead;
             uint64_t cbWakeupNotifs = ASMAtomicReadU64(&pThis->cbWakeupNotifs);
-            cbRead = recv(pThis->pWakeupSockPair[1], &ch, cbWakeupNotifs, NULL);
-            ASMAtomicSubU64(&pThis->cbWakeupNotifs, cbRead);
+
+            if (cbWakeupNotifs > 1024)
+            {
+                cbRead = recv(pThis->pWakeupSockPair[1], &ch, 1024, NULL);
+                ASMAtomicSubU64(&pThis->cbWakeupNotifs, 1024);
+            }
+            else
+            {
+                cbRead = recv(pThis->pWakeupSockPair[1], &ch, cbWakeupNotifs, NULL);
+                ASMAtomicSubU64(&pThis->cbWakeupNotifs, cbRead);
+            }
         }