VirtualBox

Ignore:
Timestamp:
Jan 11, 2019 8:00:15 PM (6 years ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
128124
Message:

3D: Parameters validation corrected, bugref:9327

Location:
trunk/src/VBox/HostServices/SharedOpenGL/crserverlib
Files:
9 edited

Legend:

Unmodified
Added
Removed
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c

    r74890 r76787  
    2929    (void) buffers;
    3030
    31     if (n >= INT32_MAX / sizeof(GLuint))
     31    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    3232    {
    3333        crError("crServerDispatchGenBuffersARB: parameter 'n' is out of range");
     
    6868    void *b;
    6969
     70    if (size <= 0 || size >= INT32_MAX / 2)
     71    {
     72        crError("crServerDispatchGetBufferSubDataARB: size is out of range");
     73        return;
     74    }
     75
    7076    b = crCalloc(size);
     77
    7178    if (b) {
    7279        cr_server.head_spu->dispatch_table.GetBufferSubDataARB( target, offset, size, b );
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_framebuffer.c

    r76553 r76787  
    2929    (void) framebuffers;
    3030
    31     if (n >= INT32_MAX / sizeof(GLuint))
     31    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    3232    {
    3333        crError("crServerDispatchGenFramebuffersEXT: parameter 'n' is out of range");
     
    4949    (void) renderbuffers;
    5050
    51     if (n >= INT32_MAX / sizeof(GLuint))
     51    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    5252    {
    5353        crError("crServerDispatchGenRenderbuffersEXT: parameter 'n' is out of range");
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_gentextures.c

    r74890 r76787  
    1717    (void) textures;
    1818
    19     if (n >= INT32_MAX / sizeof(GLuint))
     19    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    2020    {
    2121        crError("crServerDispatchGenTextures: parameter 'n' is out of range");
     
    4242    (void) ids;
    4343
    44     if (n >= INT32_MAX / sizeof(GLuint))
     44    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    4545    {
    4646        crError("crServerDispatchGenProgramsNV: parameter 'n' is out of range");
     
    6767    (void) ids;
    6868
    69     if (n >= INT32_MAX / sizeof(GLuint))
     69    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    7070    {
    7171        crError("crServerDispatchGenFencesNV: parameter 'n' is out of range");
     
    8888void SERVER_DISPATCH_APIENTRY crServerDispatchGenProgramsARB( GLsizei n, GLuint * ids )
    8989{
    90     GLuint *local_progs = (GLuint *) crAlloc( n*sizeof( *local_progs) );
     90    GLuint *local_progs;
    9191    GLsizei i;
    9292    (void) ids;
    9393
    94     if (n >= INT32_MAX / sizeof(GLuint))
     94    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    9595    {
    9696        crError("crServerDispatchGenProgramsARB: parameter 'n' is out of range");
     
    102102    if (!local_progs)
    103103    {
    104         crError("crServerDispatchGenProgramsARB: out of memory");
     104        crError("crServerDispatchGenProgramsARB: out of money");
    105105        return;
    106106    }
     
    120120    }
    121121
    122     crServerReturnValue( local_progs, n*sizeof( *local_progs ) );
     122    crServerReturnValue( local_progs, n * sizeof( *local_progs ) );
    123123    crFree( local_progs );
    124124}
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_getshaders.c

    r76553 r76787  
    3939    crGetActive_t *pLocal = NULL;
    4040
    41     if (bufSize < INT32_MAX / 2)
     41    if (bufSize > 0 && bufSize < INT32_MAX / 2)
    4242        pLocal = (crGetActive_t*)crCalloc(bufSize + sizeof(crGetActive_t));
    4343
     
    5959    crGetActive_t *pLocal = NULL;
    6060
    61     if (bufSize < INT32_MAX / 2)
     61    if (bufSize > 0 && bufSize < INT32_MAX / 2)
    6262        pLocal = (crGetActive_t*) crCalloc(bufSize + sizeof(crGetActive_t));
    6363
     
    7979    GLsizei *pLocal = NULL;
    8080
    81     if (maxCount < INT32_MAX / sizeof(GLuint) / 2)
     81    if (maxCount > 0 && maxCount < INT32_MAX / sizeof(GLuint) / 2)
    8282        pLocal = (GLsizei*) crCalloc(maxCount * sizeof(GLuint) + sizeof(GLsizei));
    8383
     
    108108    GLsizei *pLocal = NULL;
    109109
    110     if (maxCount < INT32_MAX / sizeof(VBoxGLhandleARB) / 2)
     110    if (maxCount > 0 && maxCount < INT32_MAX / sizeof(VBoxGLhandleARB) / 2)
    111111        pLocal = (GLsizei*) crCalloc(maxCount * sizeof(VBoxGLhandleARB) + sizeof(GLsizei));
    112112
     
    140140    GLuint hwid;
    141141
    142     if (maxLength < INT32_MAX / 2)
     142    if (maxLength > 0 && maxLength < INT32_MAX / 2)
    143143        pLocal = (GLsizei*) crCalloc(maxLength + sizeof(GLsizei));
    144144
     
    164164    GLsizei *pLocal = NULL;
    165165
    166     if (bufSize < INT32_MAX / 2)
     166    if (bufSize > 0 && bufSize < INT32_MAX / 2)
    167167        pLocal = (GLsizei*) crCalloc(bufSize + sizeof(GLsizei));
    168168
     
    184184    GLsizei *pLocal = NULL;
    185185
    186     if (bufSize < INT32_MAX / 2)
     186    if (bufSize > 0 && bufSize < INT32_MAX / 2)
    187187        pLocal = (GLsizei*) crCalloc(bufSize + sizeof(GLsizei));
    188188
     
    205205    GLsizei *pLocal = NULL;
    206206
    207     if (bufSize < INT32_MAX / 2)
     207    if (bufSize > 0 && bufSize < INT32_MAX / 2)
    208208        pLocal = (GLsizei*) crCalloc(bufSize + sizeof(GLsizei));
    209209
     
    230230    (void) pData;
    231231
    232     if (maxcbData < INT32_MAX / 2)
     232    if (maxcbData > 0 && maxcbData < INT32_MAX / 2)
    233233        pLocal = (GLsizei*) crCalloc(maxcbData + sizeof(GLsizei));
    234234
     
    256256    (void) pData;
    257257
    258     if (maxcbData < INT32_MAX / 2)
     258    if (maxcbData > 0 && maxcbData < INT32_MAX / 2)
    259259        pLocal = (GLsizei*) crCalloc(maxcbData + sizeof(GLsizei));
    260260
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_glsl.c

    r76553 r76787  
    182182    GLint i;
    183183
    184     if (n >= INT32_MAX / sizeof(GLuint))
     184    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    185185    {
    186186        crError("crServerDispatchDeleteProgramsARB: parameter 'n' is out of range");
     
    223223    (void) residences;
    224224
    225     if (n >= INT32_MAX / sizeof(GLuint))
     225    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    226226    {
    227227        crError("crServerDispatchAreProgramsResidentNV: parameter 'n' is out of range");
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_lists.c

    r74890 r76787  
    230230crServerDispatchCallLists( GLsizei n, GLenum type, const GLvoid *lists )
    231231{
    232     if (n >= INT32_MAX / sizeof(GLuint))
     232    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    233233    {
    234234        crError("crServerDispatchCallLists: parameter 'n' is out of range");
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_occlude.c

    r74890 r76787  
    1717    (void) queries;
    1818
    19     if (n >= INT32_MAX / sizeof(GLuint))
     19    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    2020    {
    2121        crError("crServerDispatchGenQueriesARB: parameter 'n' is out of range");
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_readpixels.c

    r74890 r76787  
    4949        uint32_t msg_len;
    5050
    51         if (bytes_per_row < 0 || bytes_per_row > UINT32_MAX / 8 || height > UINT32_MAX / 8)
     51        if (bytes_per_row <= 0 || height <= 0 || bytes_per_row > INT32_MAX / height)
    5252        {
    5353            crError("crServerDispatchReadPixels: parameters out of range");
  • TabularUnified trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_texture.c

    r76553 r76787  
    169169void SERVER_DISPATCH_APIENTRY crServerDispatchGetTexEnvfv( GLenum target, GLenum pname, GLfloat * params )
    170170{
    171     GLfloat local_params[4];
     171    GLfloat local_params[4] = {0};
    172172    (void) params;
    173173    if (GL_POINT_SPRITE != target && pname != GL_COORD_REPLACE)
     
    181181void SERVER_DISPATCH_APIENTRY crServerDispatchGetTexEnviv( GLenum target, GLenum pname, GLint * params )
    182182{
    183     GLint local_params[4];
     183    GLint local_params[4] = {0};
    184184    (void) params;
    185185    if (GL_POINT_SPRITE != target && pname != GL_COORD_REPLACE)
     
    203203    GLint i;
    204204
    205     if (n >= UINT32_MAX / sizeof(GLuint))
     205    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    206206    {
    207207        crError("crServerDispatchDeleteTextures: parameter 'n' is out of range");
     
    239239    GLint i;
    240240
    241     if (n >= INT32_MAX / sizeof(GLuint))
     241    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    242242    {
    243243        crError("crServerDispatchPrioritizeTextures: parameter 'n' is out of range");
     
    285285    (void) residences;
    286286
    287     if (n >= INT32_MAX / sizeof(GLuint))
     287    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
    288288    {
    289289        crError("crServerDispatchAreTexturesResident: parameter 'n' is out of range");
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette