Changeset 57735 in vbox for trunk/src/VBox/HostDrivers

Timestamp:

Sep 14, 2015 12:40:08 PM (9 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

102655

Message:

SUPDrv.cpp: Fixed SUP_IOCTL_LDR_LOAD regression from the szError info return change. When loading very small ELF images, like 32-bit tstRTR0MemUserKernel.r0, the total input size may end up being smaller than the return size and thereby the total request size. Thus the first cbIn validation fails as it checks it agains sizeof(SUPLDRLOAD) instead of a minimal image. The whole purpose of that test is to check whether cbImageWithTabs can safely be accessed.

File:

• trunk/src/VBox/HostDrivers/Support/SUPDrv.cpp (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/SUPDrv.cpp

@@ -1691 +1691 @@
             /* validate */
             PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
-            REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= sizeof(*pReq));
+            REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= SUP_IOCTL_LDR_LOAD_SIZE_IN(32));
             REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImageWithTabs), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
             REQ_CHECK_EXPR(SUP_IOCTL_LDR_LOAD, pReq->u.In.cSymbols <= 16384);