Changeset 71468 in vbox for trunk/src/VBox/HostServices/SharedOpenGL

Timestamp:

Mar 22, 2018 6:48:08 PM (7 years ago)

Author:

vboxsync

Message:

HostServices/SharedOpenGL: Check number of lines in shaders code, part 2.

Location:

trunk/src/VBox/HostServices/SharedOpenGL

Files:

• crserverlib/server_boundsinfo.c (modified) (2 diffs)
• crserverlib/server_stream.c (modified) (5 diffs)
• unpacker/unpack.py (modified) (3 diffs)
• unpacker/unpack_shaders.c (modified) (2 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_boundsinfo.c

@@ -297 +297 @@
                                                 crServerSetOutputBounds( mural, mural->curExtent );
                                         }
-                                        crUnpack( data_ptr, data_ptr-1, num_opcodes, &(cr_server.dispatch) );
+                    crUnpack( data_ptr, NULL, data_ptr-1, num_opcodes, &(cr_server.dispatch) );
                                 }
                         }
@@ -320 +320 @@
                                         crServerSetOutputBounds( mural, i );
                                 }
-                                crUnpack( data_ptr, data_ptr-1, num_opcodes, &(cr_server.dispatch) );
+                crUnpack( data_ptr, NULL, data_ptr-1, num_opcodes, &(cr_server.dispatch) );
                         }
                 }

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_stream.c

@@ -559 +559 @@
         const CRMessageOpcodes *msg_opcodes;
         int opcodeBytes;
-        const char *data_ptr;
+        const char *data_ptr, *data_ptr_end;
 
         RTListNodeRemove(&pIter->Node);
@@ -569 +569 @@
 
         data_ptr = (const char *) msg_opcodes + sizeof (CRMessageOpcodes) + opcodeBytes;
+        data_ptr_end = (const char *)msg_opcodes + pIter->cbMsg;
 
         crUnpack(data_ptr,                 /* first command's operands */
+                 data_ptr_end,             /* first byte after command's operands*/
                  data_ptr - 1,             /* first command's opcode */
                  msg_opcodes->numOpcodes,  /* how many opcodes */
@@ -590 +592 @@
     const CRMessageOpcodes *msg_opcodes;
     int opcodeBytes;
-    const char *data_ptr;
+    const char *data_ptr, *data_ptr_end;
 #ifdef VBOX_WITH_CRHGSMI
     PCRVBOXHGSMI_CMDDATA pCmdData = NULL;
@@ -616 +618 @@
 
     data_ptr = (const char *) msg_opcodes + sizeof(CRMessageOpcodes) + opcodeBytes;
+    data_ptr_end = (const char *)msg_opcodes + cbMsg; // Pointer to the first byte after message data
 
     enmType = crUnpackGetBufferType(data_ptr - 1,             /* first command's opcode */
@@ -677 +680 @@
     {
         crUnpack(data_ptr,                 /* first command's operands */
+                 data_ptr_end,             /* first byte after command's operands*/
                  data_ptr - 1,             /* first command's opcode */
                  msg_opcodes->numOpcodes,  /* how many opcodes */

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py

@@ -26 +26 @@
 
 DECLEXPORT(const unsigned char *) cr_unpackData = NULL;
+DECLEXPORT(const unsigned char *) cr_unpackDataEnd = NULL;
 SPUDispatchTable cr_unpackDispatch;
 
@@ -240 +241 @@
 }
 
-void crUnpack( const void *data, const void *opcodes, 
+void crUnpack( const void *data, const void *data_end, const void *opcodes, 
         unsigned int num_opcodes, SPUDispatchTable *table )
 {
@@ -253 +254 @@
     unpack_opcodes = (const unsigned char *)opcodes;
     cr_unpackData = (const unsigned char *)data;
+    cr_unpackDataEnd = (const unsigned char *)data;
 
 #if defined(CR_UNPACK_DEBUG_OPCODES) || defined(CR_UNPACK_DEBUG_LAST_OPCODES)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c

@@ -41 +41 @@
     char **ppStrings = NULL;
     GLsizei i, j, jUpTo;
-    int pos=20+count*sizeof(*pLocalLength);
-
-    if (hasNonLocalLen>0)
-    {
-        length = DATA_POINTER(pos, GLint);
-        pos += count*sizeof(*length);
-    }
-
-    if (count >= UINT32_MAX / sizeof(char*))
+    int pos, pos_check;
+
+    if (count >= UINT32_MAX / sizeof(char *) / 4)
     {
         crError("crUnpackExtendShaderSource: count %u is out of range", count);
@@ -55 +49 @@
     }
 
-    ppStrings = crAlloc(count*sizeof(char*));
+    pos = 20 + count * sizeof(*pLocalLength);
+
+    if (hasNonLocalLen > 0)
+    {
+        length = DATA_POINTER(pos, GLint);
+        pos += count * sizeof(*length);
+    }
+
+    pos_check = pos; 
+
+    if (!DATA_POINTER_CHECK(pos_check))
+    {
+        crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
+        return;
+    }
+
+    for (i = 0; i < count; ++i)
+    {
+        if (pLocalLength[i] <= 0 || pos_check >= INT32_MAX - pLocalLength[i] || !DATA_POINTER_CHECK(pos_check))
+        {
+            crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
+            return;
+        }
+
+        pos_check += pLocalLength[i];
+    }
+
+    ppStrings = crAlloc(count * sizeof(char*));
     if (!ppStrings) return;
 
-    for (i=0; i<count; ++i)
+    for (i = 0; i < count; ++i)
     {
         ppStrings[i] = DATA_POINTER(pos, char);