Changeset 78105 in vbox for trunk/src/VBox/HostServices/SharedOpenGL/unpacker

Timestamp:

Apr 10, 2019 8:01:12 PM (6 years ago)

Author:

vboxsync

Message:

GuestHost/OpenGL,HostServices/SharedOpenGL: Updates bugref:9407

Location:

trunk/src/VBox/HostServices/SharedOpenGL/unpacker

Files:

• unpack_misc.c (modified) (2 diffs)
• unpack_shaders.c (modified) (4 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_misc.c

@@ -26 +26 @@
     GLsizei n = READ_DATA( 8, GLsizei );
     const GLuint *ids = DATA_POINTER(12, GLuint);
+
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLint) / 4 || !DATA_POINTER_CHECK(12 + n * sizeof(GLuint)))
+    {
+        crError("crUnpackExtendDeleteQueriesARB: parameter 'n' is out of range");
+        return;
+    }
+
     cr_unpackDispatch.DeleteQueriesARB(n, ids);
 }
@@ -84 +91 @@
     GLint cRects = READ_DATA( 24, GLint );
     GLint *pRects = (GLint *)DATA_POINTER( 28, GLvoid );
+
+    if (cRects <= 0 || cRects >= INT32_MAX / sizeof(GLint) / 8 || !DATA_POINTER_CHECK(28 + 4 * cRects * sizeof(GLint)))
+    {
+        crError("crUnpackExtendVBoxTexPresent: parameter 'cRects' is out of range");
+        return;
+    }
+
     cr_unpackDispatch.VBoxTexPresent( texture, cfg, xPos, yPos, cRects, pRects );
 }

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c

@@ -43 +43 @@
     int pos, pos_check;
 
-    if (count <= 0 || count >= INT32_MAX / sizeof(char *) / 4)
+    if (count <= 0 || count >= INT32_MAX / sizeof(GLint) / 8)
     {
         crError("crUnpackExtendShaderSource: count %u is out of range", count);
@@ -50 +50 @@
 
     pos = 20 + count * sizeof(*pLocalLength);
+
+    if (!DATA_POINTER_CHECK(pos))
+    {
+        crError("crUnpackExtendShaderSource: pos %d is out of range", pos);
+        return;
+    }
 
     if (hasNonLocalLen > 0)
@@ -57 +63 @@
     }
 
+    if (!DATA_POINTER_CHECK(pos))
+    {
+        crError("crUnpackExtendShaderSource: pos %d is out of range", pos);
+        return;
+    }
+
     pos_check = pos;
 
-    if (!DATA_POINTER_CHECK(pos_check))
-    {
-        crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
-        return;
-    }
-
     for (i = 0; i < count; ++i)
     {
-        if (pLocalLength[i] <= 0 || pos_check >= INT32_MAX - pLocalLength[i] || !DATA_POINTER_CHECK(pos_check))
+        if (pLocalLength[i] <= 0 || pos_check >= INT32_MAX - pLocalLength[i])
         {
             crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
@@ -74 +80 @@
 
         pos_check += pLocalLength[i];
+
+        if (!DATA_POINTER_CHECK(pos_check))
+        {
+            crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
+            return;
+        }
     }