Changeset 39524 in vbox for trunk/src/VBox/Additions/WINNT/Graphics

Timestamp:

Dec 5, 2011 12:34:27 PM (13 years ago)

Author:

vboxsync

Message:

wddm: DxgkDdiCreateAllocation fix

Location:

trunk/src/VBox/Additions/WINNT/Graphics/Video

Files:

• common/wddm/VBoxMPIf.h (modified) (1 diff)
• mp/wddm/VBoxMPWddm.cpp (modified) (1 diff)

trunk/src/VBox/Additions/WINNT/Graphics/Video/common/wddm/VBoxMPIf.h

@@ -876 +876 @@
 }
 
+#define VBOXWDDM_TRAILARRAY_MAXELEMENTSU32(_t, _af) ((uint32_t)(((~(0UL)) - (uint32_t)RT_OFFSETOF(_t, _af[0])) / RT_SIZEOFMEMB(_t, _af[0])))
+
 #endif /* #ifndef ___VBoxMPIf_h___ */

trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.cpp

@@ -2105 +2105 @@
         {
             WARN(("invalid number of allocations passed in, (%d), expected (%d)", pRcInfo->cAllocInfos, pCreateAllocation->NumAllocations));
+            return STATUS_INVALID_PARAMETER;
+        }
+
+        /* a check to ensure we do not get the allocation size which is too big to overflow the 32bit value */
+        if (VBOXWDDM_TRAILARRAY_MAXELEMENTSU32(VBOXWDDM_RESOURCE, aAllocations) < pRcInfo->cAllocInfos)
+        {
+            WARN(("number of allocations passed too big (%d), max is (%d)", pRcInfo->cAllocInfos, VBOXWDDM_TRAILARRAY_MAXELEMENTSU32(VBOXWDDM_RESOURCE, aAllocations)));
             return STATUS_INVALID_PARAMETER;
         }