Changeset 79668 in vbox for trunk

Timestamp:

Jul 10, 2019 10:40:53 AM (6 years ago)

Author:

vboxsync

Message:

VMSVGA: Ignore requests to set invalid transform type or render state, bugref:9460

Location:

trunk/src/VBox/Devices/Graphics

Files:

• DevVGA-SVGA3d-ogl.cpp (modified) (4 diffs)
• DevVGA-SVGA3d-win.cpp (modified) (3 diffs)

trunk/src/VBox/Devices/Graphics/DevVGA-SVGA3d-ogl.cpp

@@ -33 +33 @@
 #include <VBox/log.h>
 #include <VBox/vmm/pgm.h>
+#include <VBox/AssertGuest.h>
 
 #include <iprt/assert.h>
@@ -3342 +3343 @@
         return VERR_INVALID_PARAMETER;
     }
+
+    ASSERT_GUEST_RETURN((unsigned)type < SVGA3D_TRANSFORM_MAX, VERR_INVALID_PARAMETER);
+
     pContext = pState->papContexts[cid];
     VMSVGA3D_SET_CURRENT_CONTEXT(pState, pContext);
@@ -3592 +3596 @@
         return VERR_INVALID_PARAMETER;
     }
+
     pContext = pState->papContexts[cid];
     VMSVGA3D_SET_CURRENT_CONTEXT(pState, pContext);
@@ -3600 +3605 @@
         Log(("vmsvga3dSetRenderState: cid=%x state=%s (%d) val=%x\n", cid, vmsvga3dGetRenderStateName(pRenderState[i].state), pRenderState[i].state, pRenderState[i].uintValue));
         /* Save the render state for vm state saving. */
-        if (pRenderState[i].state < SVGA3D_RS_MAX)
-            pContext->state.aRenderState[pRenderState[i].state] = pRenderState[i];
+        ASSERT_GUEST_RETURN((unsigned)pRenderState[i].state < SVGA3D_RS_MAX, VERR_INVALID_PARAMETER);
+        pContext->state.aRenderState[pRenderState[i].state] = pRenderState[i];
 
         switch (pRenderState[i].state)

trunk/src/VBox/Devices/Graphics/DevVGA-SVGA3d-win.cpp

@@ -26 +26 @@
 #include <VBox/log.h>
 #include <VBox/vmm/pgm.h>
+#include <VBox/AssertGuest.h>
 
 #include <iprt/assert.h>
@@ -3054 +3055 @@
     Log(("vmsvga3dSetTransform %x %s\n", cid, vmsvgaTransformToString(type)));
 
+    ASSERT_GUEST_RETURN((unsigned)type < SVGA3D_TRANSFORM_MAX, VERR_INVALID_PARAMETER);
+
     if (    cid >= pState->cContexts
         ||  pState->papContexts[cid]->id != cid)
@@ -3226 +3229 @@
         Log(("vmsvga3dSetRenderState: state=%s (%d) val=%x\n", vmsvga3dGetRenderStateName(pRenderState[i].state), pRenderState[i].state, pRenderState[i].uintValue));
         /* Save the render state for vm state saving. */
-        if (pRenderState[i].state < SVGA3D_RS_MAX)
-            pContext->state.aRenderState[pRenderState[i].state] = pRenderState[i];
+        ASSERT_GUEST_RETURN((unsigned)pRenderState[i].state < SVGA3D_RS_MAX, VERR_INVALID_PARAMETER);
+        pContext->state.aRenderState[pRenderState[i].state] = pRenderState[i];
 
         switch (pRenderState[i].state)