Changeset 78076 in vbox for trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py

Timestamp:

Apr 10, 2019 11:20:02 AM (6 years ago)

Author:

vboxsync

Message:

GuestHost/OpenGL,HostServices/SharedOpenGL: Fixed parameter validation, bugref:9433

File:

• trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py (modified) (3 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py

@@ -170 +170 @@
     print("{")
 
+    # Verify that the provided buffer length is what we expect.
+    packet_length = apiutil.PacketLength( params )
+    print("\tif(!DATA_POINTER_CHECK(%d))" % packet_length);
+    print("\t{");
+    print("\t\tcrError(\"crUnpack%s: parameters out of range\");" % func_name);
+    print("\t\treturn;");
+    print("\t}");
+
     vector_func = apiutil.VectorFunction(func_name)
     if (vector_func and len(apiutil.Parameters(vector_func)) == 1):
@@ -175 +183 @@
     else:
         MakeNormalCall( return_type, func_name, params )
-    packet_length = apiutil.PacketLength( params )
     if packet_length == 0:
         print("\tINCR_DATA_PTR_NO_ARGS( );")
@@ -330 +337 @@
             print('static void crUnpackExtend%s(void)' % func_name)
             print('{')
+
+            # Verify that the provided buffer length is what we expect.
+            packet_length = apiutil.PacketLength( params )
+            print("\tif(!DATA_POINTER_CHECK(%d))" % packet_length);
+            print("\t{");
+            print("\t\tcrError(\"crUnpack%s: parameters out of range\");" % func_name);
+            print("\t\treturn;");
+            print("\t}");
+
             MakeNormalCall( return_type, func_name, params, 8 )
             print('}\n')