Changeset 49426 in vbox for trunk/src/VBox

Timestamp:

Nov 8, 2013 4:34:34 PM (11 years ago)

Author:

vboxsync

Message:

VMMDev: check parameter.

File:

• trunk/src/VBox/Devices/VMMDev/VMMDev.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/VMMDev/VMMDev.cpp

@@ -836 +836 @@
 }
 
+static int vmmdevVerifyPointerShape(VMMDevReqMousePointer *pReq)
+{
+    /* Should be enough for most mouse pointers. */
+    if (pReq->width > 8192 || pReq->height > 8192)
+        return VERR_INVALID_PARAMETER;
+
+    uint32_t cbShape = (pReq->width + 7) / 8 * pReq->height; /* size of the AND mask */
+    cbShape = ((cbShape + 3) & ~3) + pReq->width * 4 * pReq->height; /* + gap + size of the XOR mask */
+    if (RT_UOFFSETOF(VMMDevReqMousePointer, pointerData) + cbShape > pReq->header.size)
+        return VERR_INVALID_PARAMETER;
+
+    return VINF_SUCCESS;
+}
 
 /**
@@ -871 +884 @@
     if (fShape)
     {
+        int rc = vmmdevVerifyPointerShape(pReq);
+        if (RT_FAILURE(rc))
+            return rc;
+
         pThis->pDrv->pfnUpdatePointerShape(pThis->pDrv,
                                            fVisible,