Changeset 78788 in vbox for trunk/src/VBox/GuestHost/OpenGL/include/cr_unpack.h

Timestamp:

May 27, 2019 7:06:10 PM (6 years ago)

Author:

vboxsync

Message:

GuestHost/OpenGL/include/cr_unpack.h: Bug fixes in the access verification macros

File:

• trunk/src/VBox/GuestHost/OpenGL/include/cr_unpack.h (modified) (6 diffs)

trunk/src/VBox/GuestHost/OpenGL/include/cr_unpack.h

@@ -95 +95 @@
     { \
         (a_pState)->rcUnpack = VERR_BUFFER_OVERFLOW; \
+        AssertFailed(); \
         return; \
     } \
@@ -107 +108 @@
         { \
             (a_pState)->rcUnpack = VERR_BUFFER_OVERFLOW; \
+            AssertFailed(); \
             return; \
         } \
@@ -129 +131 @@
     {
         pState->rcUnpack = VERR_BUFFER_OVERFLOW;
+        AssertFailed();
         return ~(size_t)0;
     }
@@ -168 +171 @@
     do \
     { \
-        if (RT_UNLIKELY((a_pState)->cbUnpackDataLeft < (size_t)(delta))) \
+        size_t a_cbAdv = (delta); \
+        if (RT_UNLIKELY((a_pState)->cbUnpackDataLeft < a_cbAdv)) \
         { \
           (a_pState)->rcUnpack = VERR_BUFFER_OVERFLOW; \
+          AssertFailed(); \
           return; \
         } \
-        (a_pState)->pbUnpackData     += (delta); \
-        (a_pState)->cbUnpackDataLeft -= (delta); \
+        (a_pState)->pbUnpackData     += a_cbAdv; \
+        (a_pState)->cbUnpackDataLeft -= a_cbAdv; \
     } while(0)
 
@@ -185 +190 @@
     { \
         CRDBGPTR_CHECKZ((a_pState)->pReturnPtr); \
-        if (!DATA_POINTER_CHECK(a_pState, offset + sizeof(*(a_pState)->pReturnPtr))) \
+        if (offset + sizeof(*(a_pState)->pReturnPtr) > (a_pState)->cbUnpackDataLeft) \
         { \
              crError("%s: SET_RETURN_PTR(%u) offset out of bounds\n", __FUNCTION__, offset); \
@@ -197 +202 @@
     { \
         CRDBGPTR_CHECKZ((a_pState)->pWritebackPtr); \
-        if (!DATA_POINTER_CHECK(a_pState, offset + sizeof(*(a_pState)->pWritebackPtr))) \
-        { \
-             crError("%s: SET_RETURN_PTR(%u) offset out of bounds\n", __FUNCTION__, offset); \
+        if (offset + sizeof(*(a_pState)->pWritebackPtr) > (a_pState)->cbUnpackDataLeft) \
+        { \
+             crError("%s: SET_WRITEBACK_PTR(%u) offset out of bounds\n", __FUNCTION__, offset); \
              return; \
         } \