Changeset 39603 in vbox for trunk/src/VBox/HostServices/SharedOpenGL

Timestamp:

Dec 14, 2011 11:12:56 AM (13 years ago)

Author:

vboxsync

Message:

crHgsmi: cleanup

Location:

trunk/src/VBox/HostServices/SharedOpenGL

Files:

• crserver/crservice.cpp (modified) (2 diffs)
• crserverlib/server.h (modified) (1 diff)
• crserverlib/server_main.c (modified) (11 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/crserver/crservice.cpp

@@ -939 +939 @@
             if (cParms == 1 && paParms[0].type == VBOX_HGCM_SVC_PARM_PTR)
             {
-                rc = crVBoxServerCrHgsmiCmd((PVBOXVDMACMD_CHROMIUM_CMD)paParms[0].u.pointer.addr);
+                rc = crVBoxServerCrHgsmiCmd((PVBOXVDMACMD_CHROMIUM_CMD)paParms[0].u.pointer.addr, paParms[0].u.pointer.size);
                 if (VERR_NOT_SUPPORTED == rc)
                 {
@@ -952 +952 @@
             Assert(cParms == 1 && paParms[0].type == VBOX_HGCM_SVC_PARM_PTR);
             if (cParms == 1 && paParms[0].type == VBOX_HGCM_SVC_PARM_PTR)
-                rc = crVBoxServerCrHgsmiCtl((PVBOXVDMACMD_CHROMIUM_CTL)paParms[0].u.pointer.addr);
+                rc = crVBoxServerCrHgsmiCtl((PVBOXVDMACMD_CHROMIUM_CTL)paParms[0].u.pointer.addr, paParms[0].u.pointer.size);
             else
                 rc = VERR_INVALID_PARAMETER;

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server.h

@@ -20 +20 @@
 
 extern uint8_t* g_pvVRamBase;
+extern uint32_t g_cbVRam;
 extern HCRHGSMICMDCOMPLETION g_hCrHgsmiCompletion;
 extern PFNCRHGSMICMDCOMPLETION g_pfnCrHgsmiCompletion;
 
 #define VBOXCRHGSMI_PTR(_off, _t) ((_t*)(g_pvVRamBase + (_off)))
+#define VBOXCRHGSMI_PTR_SAFE(_off, _cb, _t) ((_t*)crServerCrHgsmiPtrGet(_off, _cb))
+
+DECLINLINE(void*) crServerCrHgsmiPtrGet(VBOXVIDEOOFFSET offBuffer, uint32_t cbBuffer)
+{
+    return ((offBuffer) + (cbBuffer) <= g_cbVRam ? VBOXCRHGSMI_PTR(offBuffer, void) : NULL);
+}
 
 DECLINLINE(void) crServerCrHgsmiCmdComplete(struct VBOXVDMACMD_CHROMIUM_CMD *pCmd, int cmdProcessingRc)

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_main.c

@@ -33 +33 @@
 # include <VBox/HostServices/VBoxCrOpenGLSvc.h>
 uint8_t* g_pvVRamBase = NULL;
+uint32_t g_cbVRam = 0;
 HCRHGSMICMDCOMPLETION g_hCrHgsmiCompletion = NULL;
 PFNCRHGSMICMDCOMPLETION g_pfnCrHgsmiCompletion = NULL;
@@ -1353 +1354 @@
  * NOTE: it is ALWAYS responsibility of the crVBoxServerCrHgsmiCmd to complete the command!
  * */
-int32_t crVBoxServerCrHgsmiCmd(struct VBOXVDMACMD_CHROMIUM_CMD *pCmd)
+int32_t crVBoxServerCrHgsmiCmd(struct VBOXVDMACMD_CHROMIUM_CMD *pCmd, uint32_t cbCmd)
 {
     int32_t rc;
     uint32_t cBuffers = pCmd->cBuffers;
     uint32_t cParams;
+    uint32_t cbHdr;
     CRVBOXHGSMIHDR *pHdr;
     uint32_t u32Function;
@@ -1365 +1367 @@
     if (!g_pvVRamBase)
     {
-        CRASSERT(0);
+        crWarning("g_pvVRamBase is not initialized");
         crServerCrHgsmiCmdComplete(pCmd, VERR_INVALID_STATE);
         return VINF_SUCCESS;
@@ -1372 +1374 @@
     if (!cBuffers)
     {
-        CRASSERT(0);
+        crWarning("zero buffers passed in!");
         crServerCrHgsmiCmdComplete(pCmd, VERR_INVALID_PARAMETER);
         return VINF_SUCCESS;
@@ -1379 +1381 @@
     cParams = cBuffers-1;
 
-    pHdr = VBOXCRHGSMI_PTR(pCmd->aBuffers[0].offBuffer, CRVBOXHGSMIHDR);
+    cbHdr = pCmd->aBuffers[0].cbBuffer;
+    pHdr = VBOXCRHGSMI_PTR_SAFE(pCmd->aBuffers[0].offBuffer, cbHdr, CRVBOXHGSMIHDR);
+    if (!pHdr)
+    {
+        crWarning("invalid header buffer!");
+        crServerCrHgsmiCmdComplete(pCmd, VERR_INVALID_PARAMETER);
+        return VINF_SUCCESS;
+    }
+
+    if (cbHdr < sizeof (*pHdr))
+    {
+        crWarning("invalid header buffer size!");
+        crServerCrHgsmiCmdComplete(pCmd, VERR_INVALID_PARAMETER);
+        return VINF_SUCCESS;
+    }
+
     u32Function = pHdr->u32Function;
     u32ClientID = pHdr->u32ClientID;
@@ -1395 +1412 @@
                 VBOXVDMACMD_CHROMIUM_BUFFER *pBuf = &pCmd->aBuffers[1];
                 /* Fetch parameters. */
-                uint8_t *pBuffer  = VBOXCRHGSMI_PTR(pBuf->offBuffer, uint8_t);
                 uint32_t cbBuffer = pBuf->cbBuffer;
-
-                CRASSERT(pBuffer);
+                uint8_t *pBuffer  = VBOXCRHGSMI_PTR_SAFE(pBuf->offBuffer, cbBuffer, uint8_t);
+
+                if (cbHdr < sizeof (*pFnCmd))
+                {
+                    crWarning("invalid write cmd buffer size!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
+
                 CRASSERT(cbBuffer);
+                if (!pBuffer)
+                {
+                    crWarning("invalid buffer data received from guest!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
 
                 rc = crVBoxServerClientGet(u32ClientID, &pClient);
@@ -1438 +1467 @@
                 uint32_t u32InjectClientID = pFnCmd->u32ClientID;
                 VBOXVDMACMD_CHROMIUM_BUFFER *pBuf = &pCmd->aBuffers[1];
-                uint8_t *pBuffer  = VBOXCRHGSMI_PTR(pBuf->offBuffer, uint8_t);
                 uint32_t cbBuffer = pBuf->cbBuffer;
-
-                CRASSERT(pBuffer);
+                uint8_t *pBuffer  = VBOXCRHGSMI_PTR_SAFE(pBuf->offBuffer, cbBuffer, uint8_t);
+
+                if (cbHdr < sizeof (*pFnCmd))
+                {
+                    crWarning("invalid inject cmd buffer size!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
+
                 CRASSERT(cbBuffer);
+                if (!pBuffer)
+                {
+                    crWarning("invalid buffer data received from guest!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
 
                 rc = crVBoxServerClientGet(u32InjectClientID, &pClient);
@@ -1477 +1518 @@
                 VBOXVDMACMD_CHROMIUM_BUFFER *pBuf = &pCmd->aBuffers[1];
                 /* Fetch parameters. */
-                uint8_t *pBuffer  = VBOXCRHGSMI_PTR(pBuf->offBuffer, uint8_t);
                 uint32_t cbBuffer = pBuf->cbBuffer;
+                uint8_t *pBuffer  = VBOXCRHGSMI_PTR_SAFE(pBuf->offBuffer, cbBuffer, uint8_t);
+
+                if (cbHdr < sizeof (*pFnCmd))
+                {
+                    crWarning("invalid read cmd buffer size!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
+
+
+                if (!pBuffer)
+                {
+                    crWarning("invalid buffer data received from guest!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
 
                 rc = crVBoxServerClientGet(u32ClientID, &pClient);
@@ -1518 +1574 @@
 
                 /* Fetch parameters. */
-                uint8_t *pBuffer  = VBOXCRHGSMI_PTR(pBuf->offBuffer, uint8_t);
                 uint32_t cbBuffer = pBuf->cbBuffer;
-
-                uint8_t *pWriteback  = VBOXCRHGSMI_PTR(pWbBuf->offBuffer, uint8_t);
+                uint8_t *pBuffer  = VBOXCRHGSMI_PTR_SAFE(pBuf->offBuffer, cbBuffer, uint8_t);
+
                 uint32_t cbWriteback = pWbBuf->cbBuffer;
-
-                CRASSERT(pBuffer);
+                uint8_t *pWriteback  = VBOXCRHGSMI_PTR_SAFE(pWbBuf->offBuffer, cbWriteback, uint8_t);
+
+                if (cbHdr < sizeof (*pFnCmd))
+                {
+                    crWarning("invalid write_read cmd buffer size!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
+
+
                 CRASSERT(cbBuffer);
-
+                if (!pBuffer)
+                {
+                    crWarning("invalid write buffer data received from guest!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
+
+                CRASSERT(cbWriteback);
+                if (!pWriteback)
+                {
+                    crWarning("invalid writeback buffer data received from guest!");
+                    rc = VERR_INVALID_PARAMETER;
+                    break;
+                }
                 rc = crVBoxServerClientGet(u32ClientID, &pClient);
                 if (RT_FAILURE(rc))
@@ -1582 +1658 @@
 }
 
-int32_t crVBoxServerCrHgsmiCtl(struct VBOXVDMACMD_CHROMIUM_CTL *pCtl)
+int32_t crVBoxServerCrHgsmiCtl(struct VBOXVDMACMD_CHROMIUM_CTL *pCtl, uint32_t cbCtl)
 {
     int rc = VINF_SUCCESS;
@@ -1591 +1667 @@
         {
             PVBOXVDMACMD_CHROMIUM_CTL_CRHGSMI_SETUP pSetup = (PVBOXVDMACMD_CHROMIUM_CTL_CRHGSMI_SETUP)pCtl;
-            g_pvVRamBase = (uint8_t*)pSetup->pvRamBase;
+            g_pvVRamBase = (uint8_t*)pSetup->pvVRamBase;
+            g_cbVRam = pSetup->cbVRam;
             rc = VINF_SUCCESS;
             break;