Changeset 71588 in vbox for trunk/src/VBox/Devices

Timestamp:

Mar 31, 2018 1:47:29 PM (7 years ago)

Author:

vboxsync

Message:

DevVGA_VDMA.cpp: Added missing+buggy bits from ?bugref:9054.

File:

• trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp

@@ -2559 +2559 @@
         {
             if (   cbDstLine <= cbVRamSize
-                && (uintptr_t)pbSrcStart - (uintptr_t)pbRam <= cbVRamSize - cbDstLine
+                && (uintptr_t)pbDstStart - (uintptr_t)pbRam <= cbVRamSize - cbDstLine
                 && (uintptr_t)pbSrcStart - (uintptr_t)pbRam <= cbVRamSize - cbDstLine)
                 memcpy(pbDstStart, pbSrcStart, cbDstLine);
@@ -2715 +2715 @@
     uint32_t    cbTransfered = 0;
     int         rc           = VINF_SUCCESS;
+
+    if (pTransfer->fFlags & VBOXVDMACMD_DMA_BPB_TRANSFER_F_SRC_VRAMOFFSET)
+    {
+        if (RT_LIKELY(   pTransfer->cbTransferSize <= pVGAState->vram_size
+                      && pTransfer->Src.offVramBuf <= pVGAState->vram_size - pTransfer->cbTransferSize))
+        { /* likely */ }
+        else
+            return VERR_INVALID_PARAMETER;
+    }
+
+    if (pTransfer->fFlags & VBOXVDMACMD_DMA_BPB_TRANSFER_F_DST_VRAMOFFSET)
+    {
+        if (RT_LIKELY(   pTransfer->cbTransferSize <= pVGAState->vram_size
+                      && pTransfer->Dst.offVramBuf <= pVGAState->vram_size - pTransfer->cbTransferSize))
+        { /* likely */ }
+        else
+            return VERR_INVALID_PARAMETER;
+    }
+
     do
     {