Changeset 70601 in vbox

Timestamp:

Jan 16, 2018 4:26:58 PM (7 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

120311

Message:

3D: SharedOpenGL code cleanup, bugref:9043

Location:

trunk/src/VBox

Files:

• GuestHost/OpenGL/state_tracker/state_pixel.c (modified) (1 diff)
• HostServices/SharedOpenGL/crserverlib/server_glsl.c (modified) (1 diff)
• HostServices/SharedOpenGL/crserverlib/server_lists.c (modified) (1 diff)
• HostServices/SharedOpenGL/crserverlib/server_texture.c (modified) (1 diff)
• HostServices/SharedOpenGL/unpacker/unpack_stipple.c (modified) (1 diff)
• HostServices/SharedOpenGL/unpacker/unpack_texture.c (modified) (1 diff)

trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_pixel.c

@@ -312 +312 @@
 void STATE_APIENTRY crStatePixelMapuiv (GLenum map, GLint mapsize, const GLuint * values)
 {
-    GLfloat fvalues[CR_MAX_PIXEL_MAP_TABLE];
-    GLint i;
+    if (mapsize < 0 || mapsize > CR_MAX_PIXEL_MAP_TABLE)
+    {
+        crError("crStatePixelMapuiv: parameter 'mapsize' is out of range");
+        return;
+    }
 
     if (!crStateIsBufferBound(GL_PIXEL_UNPACK_BUFFER_ARB))
     {
+        GLfloat fvalues[CR_MAX_PIXEL_MAP_TABLE];
+        GLint i;
+
         if (map==GL_PIXEL_MAP_I_TO_I || map==GL_PIXEL_MAP_S_TO_S) {
            for (i=0;i<mapsize;i++) {

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_glsl.c

@@ -179 +179 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteProgramsARB(GLsizei n, const GLuint * programs)
 {
-    GLuint *pLocalProgs = (GLuint *) crAlloc(n * sizeof(GLuint));
+    GLuint *pLocalProgs;
     GLint i;
+
+    if (n >= UINT32_MAX / sizeof(GLuint))
+    {
+        crError("crServerDispatchDeleteProgramsARB: parameter 'n' is out of range");
+        return;
+    }
+
+    pLocalProgs = (GLuint *)crAlloc(n * sizeof(GLuint));
+
     if (!pLocalProgs) {
         crError("crServerDispatchDeleteProgramsARB: out of memory");

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_lists.c

@@ -230 +230 @@
 crServerDispatchCallLists( GLsizei n, GLenum type, const GLvoid *lists )
 {
+    if (n >= UINT32_MAX / sizeof(GLuint))
+    {
+        crError("crServerDispatchCallLists: parameter 'n' is out of range");
+        return;
+    }
+
 #ifndef VBOX_WITH_CR_DISPLAY_LISTS
     if (!cr_server.sharedDisplayLists) {

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_texture.c

@@ -200 +200 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteTextures( GLsizei n, const GLuint *textures)
 {
-    GLuint *newTextures = (GLuint *) crAlloc(n * sizeof(GLuint));
+    GLuint *newTextures;
     GLint i;
+
+    if (n >= UINT32_MAX / sizeof(GLuint))
+    {
+        crError("crServerDispatchDeleteTextures: parameter 'n' is out of range");
+        return;
+    }
+
+    newTextures = (GLuint *)crAlloc(n * sizeof(GLuint));
 
     if (!newTextures)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_stipple.c

@@ -10 +10 @@
 {
     int nodata = READ_DATA(0, int);
-    GLubyte *mask;
 
     if (nodata)
-        mask = (void*) (uintptr_t) READ_DATA(4, GLint);
+    {
+        crError("crUnpackPolygonStipple: GL_PIXEL_UNPACK_BUFFER is not supported");
+        INCR_DATA_PTR(8);
+    }
     else
-        mask = DATA_POINTER( 4, GLubyte );
+    {
+        GLubyte *mask;
 
-    cr_unpackDispatch.PolygonStipple(mask);
-
-    if (nodata)
-        INCR_DATA_PTR(8);
-    else
-        INCR_DATA_PTR(4 + 32*32/8);
+        mask = DATA_POINTER(4, GLubyte);
+        cr_unpackDispatch.PolygonStipple(mask);
+        // Stipple mask consists of 32 * 32 bits
+        INCR_DATA_PTR(4 + 32 * 32 / 8);
+    }
 }

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_texture.c

@@ -290 +290 @@
     unsigned int n_param = READ_DATA( 0, int ) - ( sizeof(int) + 8 );
 
-    if ( n_param > sizeof(params) )
-        crError( "crUnpackTexGendv: n_param=%d, expected <= %d\n", n_param,
-                 (unsigned int)sizeof(params) );
+    if (n_param > sizeof(params))
+    {
+        crError("crUnpackTexGendv: n_param=%d, expected <= %d\n", n_param,
+            (unsigned int)sizeof(params));
+        return;
+    }
+
     crMemcpy( params, DATA_POINTER( sizeof( int ) + 8, GLdouble ), n_param );