Changeset 49783 in vbox

Timestamp:

Dec 5, 2013 9:27:52 AM (11 years ago)

Author:

vboxsync

Message:

DisplayImpl: DevVGA must not access framebuffer which has incorrect size.

Location:

trunk/src/VBox/Main

Files:

• include/DisplayImpl.h (modified) (1 diff)
• src-client/DisplayImpl.cpp (modified) (6 diffs)

trunk/src/VBox/Main/include/DisplayImpl.h

@@ -204 +204 @@
 private:
 
-    void updateDisplayData(void);
+    int updateDisplayData(void);
 
 #ifdef VBOX_WITH_CRHGSMI

trunk/src/VBox/Main/src-client/DisplayImpl.cpp

@@ -811 +811 @@
         {
             /* Primary framebuffer has completed the resize. Update the connector data for VGA device. */
-            updateDisplayData();
+            int rc2 = updateDisplayData();
 
             /* Check the framebuffer pixel format to setup the rendering in VGA device. */
@@ -822 +822 @@
              * pixels from VRAM to the framebuffer.
              */
-            if (pFBInfo->fDisabled)
+            if (pFBInfo->fDisabled || RT_FAILURE(rc2))
                 mpDrv->pUpPort->pfnSetRenderVRAM (mpDrv->pUpPort, false);
             else
@@ -3192 +3192 @@
  *  @thread EMT
  */
-void Display::updateDisplayData(void)
+int Display::updateDisplayData(void)
 {
     LogRelFlowFunc(("\n"));
@@ -3198 +3198 @@
     /* the driver might not have been constructed yet */
     if (!mpDrv)
-        return;
+        return VINF_SUCCESS;
 
 #ifdef VBOX_STRICT
@@ -3239 +3239 @@
         AssertComRC (rc);
 
+        if (   (width != mLastWidth && mLastWidth != 0)
+            || (height != mLastHeight && mLastHeight != 0))
+        {
+            LogRel(("updateDisplayData: size mismatch w %d(%d) h %d(%d)\n",
+                    width, mLastWidth, height, mLastHeight));
+            return VERR_INVALID_STATE;
+        }
+
         mpDrv->IConnector.pu8Data = (uint8_t *) address;
         mpDrv->IConnector.cbScanline = bytesPerLine;
@@ -3255 +3263 @@
     }
     LogRelFlowFunc(("leave\n"));
+    return VINF_SUCCESS;
 }