Changeset 71468 in vbox for trunk/src/VBox/HostServices/SharedOpenGL/unpacker

Timestamp:

Mar 22, 2018 6:48:08 PM (7 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

121437

Message:

HostServices/SharedOpenGL: Check number of lines in shaders code, part 2.

Location:

trunk/src/VBox/HostServices/SharedOpenGL/unpacker

Files:

• unpack.py (modified) (3 diffs)
• unpack_shaders.c (modified) (2 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py

@@ -26 +26 @@
 
 DECLEXPORT(const unsigned char *) cr_unpackData = NULL;
+DECLEXPORT(const unsigned char *) cr_unpackDataEnd = NULL;
 SPUDispatchTable cr_unpackDispatch;
 
@@ -240 +241 @@
 }
 
-void crUnpack( const void *data, const void *opcodes, 
+void crUnpack( const void *data, const void *data_end, const void *opcodes, 
         unsigned int num_opcodes, SPUDispatchTable *table )
 {
@@ -253 +254 @@
     unpack_opcodes = (const unsigned char *)opcodes;
     cr_unpackData = (const unsigned char *)data;
+    cr_unpackDataEnd = (const unsigned char *)data;
 
 #if defined(CR_UNPACK_DEBUG_OPCODES) || defined(CR_UNPACK_DEBUG_LAST_OPCODES)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c

@@ -41 +41 @@
     char **ppStrings = NULL;
     GLsizei i, j, jUpTo;
-    int pos=20+count*sizeof(*pLocalLength);
-
-    if (hasNonLocalLen>0)
-    {
-        length = DATA_POINTER(pos, GLint);
-        pos += count*sizeof(*length);
-    }
-
-    if (count >= UINT32_MAX / sizeof(char*))
+    int pos, pos_check;
+
+    if (count >= UINT32_MAX / sizeof(char *) / 4)
     {
         crError("crUnpackExtendShaderSource: count %u is out of range", count);
@@ -55 +49 @@
     }
 
-    ppStrings = crAlloc(count*sizeof(char*));
+    pos = 20 + count * sizeof(*pLocalLength);
+
+    if (hasNonLocalLen > 0)
+    {
+        length = DATA_POINTER(pos, GLint);
+        pos += count * sizeof(*length);
+    }
+
+    pos_check = pos; 
+
+    if (!DATA_POINTER_CHECK(pos_check))
+    {
+        crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
+        return;
+    }
+
+    for (i = 0; i < count; ++i)
+    {
+        if (pLocalLength[i] <= 0 || pos_check >= INT32_MAX - pLocalLength[i] || !DATA_POINTER_CHECK(pos_check))
+        {
+            crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
+            return;
+        }
+
+        pos_check += pLocalLength[i];
+    }
+
+    ppStrings = crAlloc(count * sizeof(char*));
     if (!ppStrings) return;
 
-    for (i=0; i<count; ++i)
+    for (i = 0; i < count; ++i)
     {
         ppStrings[i] = DATA_POINTER(pos, char);