Changeset 37335 in vbox for trunk/src/VBox/Additions/WINNT/Graphics/Video/disp/xpdm

Timestamp:

Jun 7, 2011 8:25:17 AM (14 years ago)

Author:

vboxsync

Message:

VBoxVideo: fix integer overflow in parameters check (#5720)

File:

• trunk/src/VBox/Additions/WINNT/Graphics/Video/disp/xpdm/VBoxDispDriver.cpp (modified) (1 diff)

trunk/src/VBox/Additions/WINNT/Graphics/Video/disp/xpdm/VBoxDispDriver.cpp

@@ -943 +943 @@
                 &&  lpRgnData->rdh.dwSize == sizeof(RGNDATAHEADER)
                 &&  lpRgnData->rdh.iType  == RDH_RECTANGLES
-                &&  cjIn == lpRgnData->rdh.nCount * sizeof(RECT) + sizeof(RGNDATAHEADER))
+                &&  cjIn == ((uint64_t)lpRgnData->rdh.nCount) * sizeof(RECT) + sizeof(RGNDATAHEADER))
             {
                 DWORD   i;