Changeset 76793 in vbox for trunk/src/VBox

Timestamp:

Jan 13, 2019 8:53:58 PM (6 years ago)

Author:

vboxsync

Message:

3D: Validation of glDeleteQueries arguments

Location:

trunk/src/VBox

Files:

• GuestHost/OpenGL/state_tracker/state_occlude.c (modified) (2 diffs)
• HostServices/SharedOpenGL/crserverlib/server_bufferobject.c (modified) (2 diffs)
• HostServices/SharedOpenGL/crserverlib/server_framebuffer.c (modified) (2 diffs)

trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_occlude.c

@@ -11 +11 @@
 #include "cr_mem.h"
 
+#if !defined(IN_GUEST)
+#include "cr_unpack.h"
+#endif
 
 void
@@ -61 +64 @@
         }
 
-        if (n < 0) {
-                crStateError(__LINE__, __FILE__, GL_INVALID_VALUE,
-                                                                 "glDeleteQueriesARB(n < 0)");
-                return;
-        }
-
-        for (i = 0; i < n; i++) {
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
+    {
+        crStateError(__LINE__, __FILE__, GL_INVALID_OPERATION,
+                     "glDeleteQueriesARB: parameter 'n' is out of range");
+        return;
+    }
+
+#if !defined(IN_GUEST)
+    if (!DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("glDeleteQueriesARB: parameter 'n' is out of range");
+        return;
+    }
+#endif
+
+    for (i = 0; i < n; i++) {
                 if (ids[i]) {
                         CROcclusionObject *q = (CROcclusionObject *)

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c

@@ -10 +10 @@
 #include "server_dispatch.h"
 #include "server.h"
+#include "cr_unpack.h"
 
 void * SERVER_DISPATCH_APIENTRY
@@ -51 +52 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteBuffersARB( GLsizei n, const GLuint * buffer )
 {
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) || !DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("glDeleteBuffersARB: parameter 'n' is out of range");
+        return;
+    }
+
     crStateDeleteBuffersARB( n, buffer );
 }

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_framebuffer.c

@@ -22 +22 @@
 #include "server_dispatch.h"
 #include "server.h"
+#include "cr_unpack.h"
 
 void SERVER_DISPATCH_APIENTRY
@@ -181 +182 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteFramebuffersEXT(GLsizei n, const GLuint * framebuffers)
 {
-        crStateDeleteFramebuffersEXT(n, framebuffers);
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) || !DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("crStateDeleteFramebuffersEXT: parameter 'n' is out of range");
+        return;
+    }
+
+    crStateDeleteFramebuffersEXT(n, framebuffers);
 }
 
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteRenderbuffersEXT(GLsizei n, const GLuint * renderbuffers)
 {
-        crStateDeleteRenderbuffersEXT(n, renderbuffers);
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) || !DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("glDeleteRenderbuffersEXT: parameter 'n' is out of range");
+        return;
+    }
+
+    crStateDeleteRenderbuffersEXT(n, renderbuffers);
 }