Changeset 37384 in vbox for trunk/src/VBox/Devices/VMMDev/VMMDev.cpp

Timestamp:

Jun 8, 2011 3:09:14 PM (14 years ago)

Author:

vboxsync

Message:

1 million rectangles ought to be enough for anybody...

File:

• trunk/src/VBox/Devices/VMMDev/VMMDev.cpp (modified) (1 diff)

trunk/src/VBox/Devices/VMMDev/VMMDev.cpp

@@ -1487 +1487 @@
                 VMMDevVideoSetVisibleRegion *ptr = (VMMDevVideoSetVisibleRegion *)pRequestHeader;
 
-                if (pRequestHeader->size != sizeof(VMMDevVideoSetVisibleRegion) + (uint64_t)ptr->cRect * sizeof(RTRECT) - sizeof(RTRECT))
-                {
-                    Log(("VMMDevReq_VideoSetVisibleRegion request size too small!!!\n"));
+                if (   ptr->cRects > _1M /* restrict to sane range */
+                    || pRequestHeader->size != sizeof(VMMDevVideoSetVisibleRegion) + ptr->cRect * sizeof(RTRECT) - sizeof(RTRECT))
+                {
+                    Log(("VMMDevReq_VideoSetVisibleRegion: cRects=%#x doesn't match size=%#x or is out of bounds\n",
+                         ptr->cRects, pRequestHeader->size));
                     pRequestHeader->rc = VERR_INVALID_PARAMETER;
                 }