Changeset 25073 in vbox

Timestamp:

Nov 28, 2009 9:11:05 PM (15 years ago)

Author:

vboxsync

Message:

VMMDevHGCM.cpp: VBOXHGCMCMD::cbCmd isn't very helpful now that the rules of the saved state game has changed. When loading / teleporting the state on a machine where VBOXHGCMCMD or/and VBOXHGCMSVCPARM is larger (either due to it being 64-bit or because of different alignment rules (GCPhys & MSC)), we would allocate too little memory for it and end up corrupting the heap.

As a very temporary measure, I have quadrupled cbSize before passing it to RTMemAllocZ and when used in comparisons. (The value in VBOXHGCMCMD::cbCmd should not be changed in case it is saved again.)

File:

• trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp (modified) (6 diffs)

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp

@@ -82 +82 @@
      * This field simplifies loading of saved state.
      */
+/** @todo @bugref{4500} - Now that we require states to be portable between
+ * systems and between 32-bit/64-bit variants of the same OS, this field no
+ * longer simplifies loading of saved state. :-(  Needs proper fixing... */
     uint32_t cbCmd;
+/** HACK ALERT! (TEMPORARY)
+ * Factor to muliply cbCmd by when reading it from a saved state.  */
+#define CMD_SIZE_HACK_FACTOR    4
 
     /* The type of the command. */
@@ -496 +502 @@
     uint32_t cbCmdSize = sizeof (struct VBOXHGCMCMD) + pHGCMConnect->header.header.size;
 
+#ifdef CMD_SIZE_HACK_FACTOR /*HACK ALERT!*/
+    if (pSavedCmd->cbCmd * CMD_SIZE_HACK_FACTOR < cbCmdSize)
+#else
     if (pSavedCmd->cbCmd < cbCmdSize)
+#endif
     {
         logRelSavedCmdSizeMismatch ("HGCMConnect", pSavedCmd->cbCmd, cbCmdSize);
@@ -552 +562 @@
     uint32_t cbCmdSize = sizeof (struct VBOXHGCMCMD);
 
+#ifdef CMD_SIZE_HACK_FACTOR  /*HACK ALERT!*/
+    if (pSavedCmd->cbCmd * CMD_SIZE_HACK_FACTOR < cbCmdSize)
+#else
     if (pSavedCmd->cbCmd < cbCmdSize)
+#endif
     {
         logRelSavedCmdSizeMismatch ("HGCMConnect", pSavedCmd->cbCmd, cbCmdSize);
@@ -2093 +2107 @@
 
             /* Size of entire command. */
+/** @todo @bugref{4500} - Not portable, see other todos. */
             rc = SSMR3PutU32(pSSM, pIter->cbCmd);
             AssertRCReturn(rc, rc);
@@ -2162 +2177 @@
 }
 
-/* @thread EMT */
+/** @thread EMT(0) */
 int vmmdevHGCMLoadState(VMMDevState *pVMMDevState, PSSMHANDLE pSSM, uint32_t uVersion)
 {
@@ -2222 +2237 @@
 
             /* Size of entire command. */
+/** @todo @bugref{4500} - Not portable, see other todos. */
             rc = SSMR3GetU32(pSSM, &u32);
             AssertRCReturn(rc, rc);
 
-            PVBOXHGCMCMD pCmd = (PVBOXHGCMCMD)RTMemAllocZ (u32);
+            PVBOXHGCMCMD pCmd = (PVBOXHGCMCMD)RTMemAllocZ (u32 * CMD_SIZE_HACK_FACTOR); /*HACK ALERT!*/
             AssertReturn(pCmd, VERR_NO_MEMORY);
             pCmd->cbCmd = u32;