Changeset 75754 in vbox

Timestamp:

Nov 27, 2018 12:53:03 AM (6 years ago)

Author:

vboxsync

Message:

VMMDevHGCM: don't overflow guest buffers.

File:

• trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp (modified) (3 diffs)

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp

@@ -591 +591 @@
     uint8_t *pu8Src = (uint8_t *)pvSrc;
     uint32_t offPage = pPtr->offFirstPage;
-    uint32_t cbRemaining = cbSrc;
+    uint32_t cbRemaining = RT_MIN(cbSrc, pPtr->cbData);
 
     uint32_t iPage;
@@ -1206 +1206 @@
             case VMMDevHGCMParmType_PageList:
             {
+/** @todo Update the return buffer size.  */
                 const VBOXHGCMPARMPTR * const pPtr = &pGuestParm->u.ptr;
                 if (   pPtr->cbData > 0
@@ -1219 +1220 @@
             case VMMDevHGCMParmType_Embedded:
             {
+/** @todo Update the return buffer size!  */
                 const VBOXHGCMPARMPTR * const pPtr = &pGuestParm->u.ptr;
                 if (   pPtr->cbData > 0
                     && (pPtr->fu32Direction & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST))
                 {
-                    const void *pvSrc = pHostParm->u.pointer.addr;
-                    uint32_t    cbSrc = pHostParm->u.pointer.size;
+                    const void *pvSrc    = pHostParm->u.pointer.addr;
+                    uint32_t    cbSrc    = pHostParm->u.pointer.size;
+                    uint32_t    cbToCopy = RT_MIN(cbSrc, pPtr->cbData);
                     if (pCmd->pvReqLocked)
-                        memcpy((uint8_t *)pCmd->pvReqLocked + pPtr->offFirstPage, pvSrc, cbSrc);
+                        memcpy((uint8_t *)pCmd->pvReqLocked + pPtr->offFirstPage, pvSrc, cbToCopy);
                     else
-                        rc = PDMDevHlpPhysWrite(pThis->pDevInsR3, pGuestParm->u.ptr.GCPhysSinglePage, pvSrc, cbSrc);
+                        rc = PDMDevHlpPhysWrite(pThis->pDevInsR3, pGuestParm->u.ptr.GCPhysSinglePage, pvSrc, cbToCopy);
                 }
                 break;