Changeset 49846 in vbox for trunk/src

Timestamp:

Dec 9, 2013 3:41:02 PM (11 years ago)

Author:

vboxsync

Message:

HGCM: check size.

File:

• trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp (modified) (4 diffs)

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp

@@ -686 +686 @@
                     {
                         /* Only pointers with some actual data are counted. */
+                        if (pGuestParm->u.Pointer.size > VMMDEV_MAX_HGCM_DATA_SIZE - cbCmdSize)
+                        {
+                            rc = VERR_INVALID_PARAMETER;
+                            break;
+                        }
+
                         cbCmdSize += pGuestParm->u.Pointer.size;
 
@@ -699 +705 @@
                 case VMMDevHGCMParmType_PageList:
                 {
+                    if (pGuestParm->u.PageList.size > VMMDEV_MAX_HGCM_DATA_SIZE - cbCmdSize)
+                    {
+                        rc = VERR_INVALID_PARAMETER;
+                        break;
+                    }
+
                     cbCmdSize += pGuestParm->u.PageList.size;
                     Log(("vmmdevHGCMCall: pagelist size = %d\n", pGuestParm->u.PageList.size));
@@ -738 +750 @@
                     {
                         /* Only pointers with some actual data are counted. */
+                        if (pGuestParm->u.Pointer.size > VMMDEV_MAX_HGCM_DATA_SIZE - cbCmdSize)
+                        {
+                            rc = VERR_INVALID_PARAMETER;
+                            break;
+                        }
+
                         cbCmdSize += pGuestParm->u.Pointer.size;
 
@@ -751 +769 @@
                 case VMMDevHGCMParmType_PageList:
                 {
+                    if (pGuestParm->u.PageList.size > VMMDEV_MAX_HGCM_DATA_SIZE - cbCmdSize)
+                    {
+                        rc = VERR_INVALID_PARAMETER;
+                        break;
+                    }
+
                     cbCmdSize += pGuestParm->u.PageList.size;
                     Log(("vmmdevHGCMCall: pagelist size = %d\n", pGuestParm->u.PageList.size));