Changeset 46720 in vbox for trunk/src/VBox/Main/xml

Timestamp:

Jun 21, 2013 10:07:31 AM (12 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

86641

Message:

Main/xml/Settings.cpp: limit snapshot depth to 250, avoiding crashes
Main/Snapshot: limit snapshot depth to 250
Main/Medium: eliminate some spurious error messages when saving a VM config

File:

• trunk/src/VBox/Main/xml/Settings.cpp (modified) (7 diffs)

trunk/src/VBox/Main/xml/Settings.cpp

@@ -3479 +3479 @@
  * Snapshot structure.
  *
+ * @param depth
  * @param elmSnapshot
  * @param snap
  */
-void MachineConfigFile::readSnapshot(const xml::ElementNode &elmSnapshot,
+void MachineConfigFile::readSnapshot(uint32_t depth,
+                                     const xml::ElementNode &elmSnapshot,
                                      Snapshot &snap)
 {
+    if (depth > SETTINGS_SNAPSHOT_DEPTH_MAX)
+        throw ConfigFileError(this, &elmSnapshot, N_("Maximum snapshot tree depth of %u exceeded"), depth);
+
     Utf8Str strTemp;
 
@@ -3531 +3536 @@
                 if (pelmChildSnapshot->nameEquals("Snapshot"))
                 {
-                    Snapshot child;
-                    readSnapshot(*pelmChildSnapshot, child);
-                    snap.llChildSnapshots.push_back(child);
+                    // Use the heap to reduce the stack footprint. Each
+                    // recursion needs over 1K, and there can be VMs with
+                    // deeply nested snapshots. The stack can be quite
+                    // small, especially with XPCOM.
+                    Snapshot *child = new Snapshot();
+                    readSnapshot(depth + 1, *pelmChildSnapshot, *child);
+                    snap.llChildSnapshots.push_back(*child);
+                    delete child;
                 }
             }
@@ -3670 +3680 @@
                 Snapshot snap;
                 // this will recurse into child snapshots, if necessary
-                readSnapshot(*pelmMachineChild, snap);
+                readSnapshot(1, *pelmMachineChild, snap);
                 llFirstSnapshot.push_back(snap);
             }
@@ -4551 +4561 @@
              && (sc.controllerType == StorageControllerType_I82078)
            )
-            // floppy controller already got written into <Hardware>/<FloppyController> in writeHardware()
+            // floppy controller already got written into <Hardware>/<FloppyController> in buildHardwareXML()
             // for pre-1.9 settings
             continue;
@@ -4751 +4761 @@
  * for the root snapshot of a machine, if present; elmParent then points to the <Snapshots> node under the
  * <Machine> node to which <Snapshot> must be added. This may then recurse for child snapshots.
+ *
+ * @param depth
  * @param elmParent
  * @param snap
  */
-void MachineConfigFile::buildSnapshotXML(xml::ElementNode &elmParent,
+void MachineConfigFile::buildSnapshotXML(uint32_t depth,
+                                         xml::ElementNode &elmParent,
                                          const Snapshot &snap)
 {
+    if (depth > SETTINGS_SNAPSHOT_DEPTH_MAX)
+        throw ConfigFileError(this, NULL, N_("Maximum snapshot tree depth of %u exceeded"), SETTINGS_SNAPSHOT_DEPTH_MAX);
+
     xml::ElementNode *pelmSnapshot = elmParent.createChild("Snapshot");
 
@@ -4788 +4804 @@
         {
             const Snapshot &child = *it;
-            buildSnapshotXML(*pelmChildren, child);
+            buildSnapshotXML(depth + 1, *pelmChildren, child);
         }
     }
@@ -4925 +4941 @@
     if (    (fl & BuildMachineXML_IncludeSnapshots)
          && llFirstSnapshot.size())
-        buildSnapshotXML(elmMachine, llFirstSnapshot.front());
+        buildSnapshotXML(1, elmMachine, llFirstSnapshot.front());
 
     buildHardwareXML(elmMachine, hardwareMachine, storageMachine);