Changeset 28948 in vbox for trunk/src/VBox/Devices/Storage

Timestamp:

Apr 30, 2010 9:19:04 PM (15 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

60938

Message:

DiskIntegrity: Fix memory corruption caused by the trace option. The index for the next free slot must be clipped always or we write beyond the array

File:

• trunk/src/VBox/Devices/Storage/DrvDiskIntegrity.cpp (modified) (3 diffs)

trunk/src/VBox/Devices/Storage/DrvDiskIntegrity.cpp

@@ -405 +405 @@
 
     /* Search for the next one. */
-    pThis->iNextFreeSlot++;
     while (pThis->apReqActive[pThis->iNextFreeSlot].pIoReq)
-        pThis->iNextFreeSlot = pThis->iNextFreeSlot++ % RT_ELEMENTS(pThis->apReqActive);
+        pThis->iNextFreeSlot = (pThis->iNextFreeSlot+1) % RT_ELEMENTS(pThis->apReqActive);
 }
 
@@ -526 +525 @@
                                              size_t cbRead, void *pvUser)
 {
-     LogFlow(("%s: uOffset=%#llx paSeg=%#p cSeg=%u cbRead=%d\n pvUser=%#p", __FUNCTION__,
+     LogFlow(("%s: uOffset=%#llx paSeg=%#p cSeg=%u cbRead=%d pvUser=%#p\n", __FUNCTION__,
              uOffset, paSeg, cSeg, cbRead, pvUser));
     PDRVDISKINTEGRITY pThis = PDMIMEDIAASYNC_2_DRVDISKINTEGRITY(pInterface);
@@ -561 +560 @@
                                               size_t cbWrite, void *pvUser)
 {
-     LogFlow(("%s: uOffset=%#llx paSeg=%#p cSeg=%u cbWrite=%d\n pvUser=%#p", __FUNCTION__,
+     LogFlow(("%s: uOffset=%#llx paSeg=%#p cSeg=%u cbWrite=%d pvUser=%#p\n", __FUNCTION__,
              uOffset, paSeg, cSeg, cbWrite, pvUser));
     PDRVDISKINTEGRITY pThis = PDMIMEDIAASYNC_2_DRVDISKINTEGRITY(pInterface);