Changeset 76787 in vbox for trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_visibleregion.c

Timestamp:

Jan 11, 2019 8:00:15 PM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

128124

Message:

3D: Parameters validation corrected, bugref:9327

File:

• trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_visibleregion.c (modified) (1 diff)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_visibleregion.c

@@ -26 +26 @@
     GLint window = READ_DATA( 8, GLint );
     GLint cRects = READ_DATA( 12, GLint );
-    GLvoid *pRects = DATA_POINTER( 16, GLvoid );;
+    GLvoid *pRects = DATA_POINTER( 16, GLvoid );
+
+    if (cRects <= 0 || cRects >= INT32_MAX / sizeof(GLint) / 8 || !DATA_POINTER_CHECK(16 + 4 * cRects * sizeof(GLint)))
+    {
+        crError("crUnpackExtendWindowVisibleRegion: parameter 'cRects' is out of range");
+        return;
+    }
+
     cr_unpackDispatch.WindowVisibleRegion( window, cRects, pRects );
 }