Changeset 76793 in vbox for trunk/src/VBox/GuestHost/OpenGL

Timestamp:

Jan 13, 2019 8:53:58 PM (6 years ago)

Author:

vboxsync

Message:

3D: Validation of glDeleteQueries arguments

File:

• trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_occlude.c (modified) (2 diffs)

trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_occlude.c

@@ -11 +11 @@
 #include "cr_mem.h"
 
+#if !defined(IN_GUEST)
+#include "cr_unpack.h"
+#endif
 
 void
@@ -61 +64 @@
         }
 
-        if (n < 0) {
-                crStateError(__LINE__, __FILE__, GL_INVALID_VALUE,
-                                                                 "glDeleteQueriesARB(n < 0)");
-                return;
-        }
-
-        for (i = 0; i < n; i++) {
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
+    {
+        crStateError(__LINE__, __FILE__, GL_INVALID_OPERATION,
+                     "glDeleteQueriesARB: parameter 'n' is out of range");
+        return;
+    }
+
+#if !defined(IN_GUEST)
+    if (!DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("glDeleteQueriesARB: parameter 'n' is out of range");
+        return;
+    }
+#endif
+
+    for (i = 0; i < n; i++) {
                 if (ids[i]) {
                         CROcclusionObject *q = (CROcclusionObject *)