Changeset 34776 in vbox for trunk/src/VBox

Timestamp:

Dec 7, 2010 12:07:45 PM (14 years ago)

Author:

vboxsync

Message:

GuestControl/service: Check for HGCM buffer size.

File:

• trunk/src/VBox/HostServices/GuestControl/service.cpp (modified) (1 diff)

trunk/src/VBox/HostServices/GuestControl/service.cpp

@@ -431 +431 @@
 
                 case VBOX_HGCM_SVC_PARM_PTR:
-                    memcpy(paParms[i].u.pointer.addr,
-                           pBuf->pParms[i].u.pointer.addr,
-                           pBuf->pParms[i].u.pointer.size);
+                    if (paParms[i].u.pointer.size >= pBuf->pParms[i].u.pointer.size)
+                    {
+                        memcpy(paParms[i].u.pointer.addr,
+                               pBuf->pParms[i].u.pointer.addr,
+                               pBuf->pParms[i].u.pointer.size);
+                    }
+                    else
+                        rc = VERR_BUFFER_OVERFLOW;
                     break;