Changeset 23916 in vbox for trunk/src/VBox/Additions/WINNT

Timestamp:

Oct 20, 2009 5:14:40 PM (16 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

53721

Message:

Verify VMMREQUEST (xTracker #4336).

File:

• trunk/src/VBox/Additions/WINNT/VBoxGuest/VBoxGuest.cpp (modified) (1 diff)

trunk/src/VBox/Additions/WINNT/VBoxGuest/VBoxGuest.cpp

@@ -963 +963 @@
             CHECK_SIZE(vmmdevGetRequestSize(requestHeader->requestType));
 
+            int rc = VbglGRVerify(requestHeader, requestHeader->size);
+            if (RT_FAILURE(rc))
+            {
+                dprintf(("VBoxGuest::VBoxGuestDeviceControl: VMMREQUEST: invalid header: size %#x, expected >= %#x (hdr); type=%#x; rc %d!!\n",
+                     requestHeader->size, vmmdevGetRequestSize(requestHeader->requestType), requestHeader->requestType, rc));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+
             /* just perform the request */
             VMMDevRequestHeader *req = NULL;
 
-            int rc = VbglGRAlloc((VMMDevRequestHeader **)&req, requestHeader->size, requestHeader->requestType);
+            rc = VbglGRAlloc((VMMDevRequestHeader **)&req, requestHeader->size, requestHeader->requestType);
 
             if (RT_SUCCESS(rc))