Changeset 76787 in vbox for trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c

Timestamp:

Jan 11, 2019 8:00:15 PM (6 years ago)

Author:

vboxsync

Message:

3D: Parameters validation corrected, bugref:9327

File:

• trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c (modified) (5 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c

@@ -45 +45 @@
     GLdouble *params;
 
-    if (num >= UINT32_MAX / (4 * sizeof(GLdouble)))
+    if (num <= 0 || num >= INT32_MAX / (4 * sizeof(GLdouble)))
     {
         crError("crUnpackExtendProgramParameters4dvNV: parameter 'num' is out of range");
@@ -71 +71 @@
     GLfloat *params;
 
-    if (num >= UINT32_MAX / (4 * sizeof(GLfloat)))
+    if (num <= 0 || num >= INT32_MAX / (4 * sizeof(GLfloat)))
     {
         crError("crUnpackExtendProgramParameters4fvNV: parameter 'num' is out of range");
@@ -95 +95 @@
     const GLuint *programs = DATA_POINTER(12, const GLuint);
 
-    if (n > UINT32_MAX / sizeof(GLuint) / 4 || !DATA_POINTER_CHECK(20 + n * sizeof(GLuint)))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) / 4 || !DATA_POINTER_CHECK(20 + n * sizeof(GLuint)))
     {
         crError("crUnpackExtendAreProgramsResidentNV: %d is out of range", n);
@@ -226 +226 @@
     const GLubyte *name = DATA_POINTER(16, GLubyte);
 
-    if (len > UINT32_MAX / 4 || !DATA_POINTER_CHECK(16 + len + 8))
+    if (len <= 0 || len >= INT32_MAX / 4 || !DATA_POINTER_CHECK(16 + len + 8))
     {
         crError("crUnpackExtendGetProgramNamedParameterdvNV: len %d is out of range", len);
@@ -243 +243 @@
     const GLubyte *name = DATA_POINTER(16, GLubyte);
 
-    if (len > UINT32_MAX / 4 || !DATA_POINTER_CHECK(16 + len + 8))
+    if (len <= 0 || len >= INT32_MAX / 4 || !DATA_POINTER_CHECK(16 + len + 8))
     {
         crError("crUnpackExtendGetProgramNamedParameterfvNV: len %d is out of range", len);