Changeset 510 in vbox for trunk/src

Timestamp:

Feb 1, 2007 2:50:40 PM (18 years ago)

Author:

vboxsync

Message:

Fixed the VBVA buffer overwrite in the Linux guest video driver.

File:

• trunk/src/VBox/Additions/linux/xgraphics/vboxutils.c (modified) (2 diffs)

trunk/src/VBox/Additions/linux/xgraphics/vboxutils.c

@@ -263 +263 @@
         }
         /* Now copy the data into the buffer */
-        if (off32Data + sizeof(cmdHdr) < VBVA_RING_BUFFER_SIZE)
+        if (off32Free + sizeof(cmdHdr) < VBVA_RING_BUFFER_SIZE)
         {
             memcpy(&pMem->au8RingBuffer[off32Free], &cmdHdr,
@@ -276 +276 @@
             CARD32 u32Second = sizeof(cmdHdr) - u32First;
             memcpy(&pMem->au8RingBuffer[off32Free], &cmdHdr, u32First);
-            memcpy(&pMem->au8RingBuffer[0], (void *)pu8Second, u32Second);
+            if (u32Second)
+                memcpy(&pMem->au8RingBuffer[0], (void *)pu8Second, u32Second);
             pMem->off32Free = u32Second;
         }