Changeset 76793 in vbox for trunk/src/VBox/HostServices/SharedOpenGL

Timestamp:

Jan 13, 2019 8:53:58 PM (6 years ago)

Author:

vboxsync

Message:

3D: Validation of glDeleteQueries arguments

Location:

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib

Files:

• server_bufferobject.c (modified) (2 diffs)
• server_framebuffer.c (modified) (2 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c

@@ -10 +10 @@
 #include "server_dispatch.h"
 #include "server.h"
+#include "cr_unpack.h"
 
 void * SERVER_DISPATCH_APIENTRY
@@ -51 +52 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteBuffersARB( GLsizei n, const GLuint * buffer )
 {
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) || !DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("glDeleteBuffersARB: parameter 'n' is out of range");
+        return;
+    }
+
     crStateDeleteBuffersARB( n, buffer );
 }

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_framebuffer.c

@@ -22 +22 @@
 #include "server_dispatch.h"
 #include "server.h"
+#include "cr_unpack.h"
 
 void SERVER_DISPATCH_APIENTRY
@@ -181 +182 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteFramebuffersEXT(GLsizei n, const GLuint * framebuffers)
 {
-        crStateDeleteFramebuffersEXT(n, framebuffers);
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) || !DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("crStateDeleteFramebuffersEXT: parameter 'n' is out of range");
+        return;
+    }
+
+    crStateDeleteFramebuffersEXT(n, framebuffers);
 }
 
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteRenderbuffersEXT(GLsizei n, const GLuint * renderbuffers)
 {
-        crStateDeleteRenderbuffersEXT(n, renderbuffers);
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) || !DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("glDeleteRenderbuffersEXT: parameter 'n' is out of range");
+        return;
+    }
+
+    crStateDeleteRenderbuffersEXT(n, renderbuffers);
 }