Changeset 81859 in vbox for trunk/src/VBox

Timestamp:

Nov 15, 2019 12:32:18 AM (5 years ago)

Author:

vboxsync

Message:

DevATA: Make sure to use a valid index into the function tables. bugref:9218

File:

• trunk/src/VBox/Devices/Storage/DevATA.cpp (modified) (18 diffs)

trunk/src/VBox/Devices/Storage/DevATA.cpp

@@ -676 +676 @@
 
 # ifdef IN_RING3
-typedef void (*PBeginTransferFunc)(ATADevState *);
-typedef bool (*PSourceSinkFunc)(ATADevState *);
+typedef void (*PFNBEGINTRANSFER)(ATADevState *);
+typedef bool (*PFNSOURCESINK)(ATADevState *);
 
 static void ataR3ReadWriteSectorsBT(ATADevState *);
@@ -730 +730 @@
  * Make sure ATAFNET and this array match!
  */
-static const PBeginTransferFunc g_apfnBeginTransFuncs[ATAFN_BT_MAX] =
+static const PFNBEGINTRANSFER g_apfnBeginTransFuncs[ATAFN_BT_MAX] =
 {
     NULL,
@@ -780 +780 @@
  * Make sure ATAFNSS and this array match!
  */
-static const PSourceSinkFunc g_apfnSourceSinkFuncs[ATAFN_SS_MAX] =
+static const PFNSOURCESINK g_apfnSourceSinkFuncs[ATAFN_SS_MAX] =
 {
     NULL,
@@ -4823 +4823 @@
          * very similarly by not continuing with the current instruction
          * until the transfer to/from the storage medium is completed. */
-        if (s->iSourceSink != ATAFN_SS_NULL)
+        uint8_t const iSourceSink = s->iSourceSink;
+        if (   iSourceSink != ATAFN_SS_NULL
+            && iSourceSink < RT_ELEMENTS(g_apfnSourceSinkFuncs))
         {
             bool fRedo;
@@ -4829 +4831 @@
             ataSetStatusValue(s, ATA_STAT_BUSY);
             Log2(("%s: calling source/sink function\n", __FUNCTION__));
-            fRedo = g_apfnSourceSinkFuncs[s->iSourceSink](s);
+            fRedo = g_apfnSourceSinkFuncs[iSourceSink](s);
             pCtl->fRedo = fRedo;
             if (RT_UNLIKELY(fRedo))
@@ -4837 +4839 @@
             s->iIOBufferEnd = s->cbElementaryTransfer;
         }
+        else
+            Assert(iSourceSink == ATAFN_SS_NULL);
 # else
         AssertReleaseFailed();
@@ -5441 +5445 @@
                  * the guest can continue in parallel). If so, the state
                  * is already set up so the loop is exited immediately. */
-                if (s->iSourceSink != ATAFN_SS_NULL)
+                uint8_t const iSourceSink = s->iSourceSink;
+                if (   iSourceSink != ATAFN_SS_NULL
+                    && iSourceSink < RT_ELEMENTS(g_apfnSourceSinkFuncs))
                 {
                     s->iIOBufferCur = iIOBufferCur;
@@ -5448 +5454 @@
                     s->cbTotalTransfer = cbTotalTransfer;
                     Log2(("%s: calling source/sink function\n", __FUNCTION__));
-                    fRedo = g_apfnSourceSinkFuncs[s->iSourceSink](s);
+                    fRedo = g_apfnSourceSinkFuncs[iSourceSink](s);
                     if (RT_UNLIKELY(fRedo))
                     {
@@ -5471 +5477 @@
                 {
                     /* This forces the loop to exit immediately. */
+                    Assert(iSourceSink == ATAFN_SS_NULL);
                     GCPhysDesc = pCtl->GCPhysLastDMADesc + 1;
                 }
@@ -5636 +5643 @@
         {
             case ATA_AIO_NEW:
-
+            {
                 pCtl->iAIOIf = pReq->u.t.iIf;
                 s = &pCtl->aIfs[pCtl->iAIOIf & ATA_SELECTED_IF_MASK];
@@ -5668 +5675 @@
                 pCtl->fChainedTransfer = false;
 
-                if (s->iBeginTransfer != ATAFN_BT_NULL)
+                uint8_t const iBeginTransfer = s->iBeginTransfer;
+                if (   iBeginTransfer != ATAFN_BT_NULL
+                    && iBeginTransfer < RT_ELEMENTS(g_apfnBeginTransFuncs))
                 {
                     Log2(("%s: Ctl#%d: calling begin transfer function\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
-                    g_apfnBeginTransFuncs[s->iBeginTransfer](s);
+                    g_apfnBeginTransFuncs[iBeginTransfer](s);
                     s->iBeginTransfer = ATAFN_BT_NULL;
                     if (s->uTxDir != PDMMEDIATXDIR_FROM_DEVICE)
@@ -5678 +5687 @@
                 else
                 {
+                    Assert(iBeginTransfer == ATAFN_BT_NULL);
                     s->cbElementaryTransfer = s->cbTotalTransfer;
                     s->iIOBufferEnd = s->cbTotalTransfer;
@@ -5685 +5695 @@
                 if (s->uTxDir != PDMMEDIATXDIR_TO_DEVICE)
                 {
-                    if (s->iSourceSink != ATAFN_SS_NULL)
+                    uint8_t const iSourceSink = s->iSourceSink;
+                    if (   iSourceSink != ATAFN_SS_NULL
+                        && iSourceSink < RT_ELEMENTS(g_apfnSourceSinkFuncs))
                     {
                         bool fRedo;
                         Log2(("%s: Ctl#%d: calling source/sink function\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
-                        fRedo = g_apfnSourceSinkFuncs[s->iSourceSink](s);
+                        fRedo = g_apfnSourceSinkFuncs[iSourceSink](s);
                         pCtl->fRedo = fRedo;
                         if (RT_UNLIKELY(fRedo && !pCtl->fReset))
@@ -5702 +5714 @@
                     }
                     else
+                    {
+                        Assert(iSourceSink == ATAFN_SS_NULL);
                         ataR3CmdOK(s, 0);
+                    }
                     s->iIOBufferEnd = s->cbElementaryTransfer;
 
@@ -5778 +5793 @@
                 }
                 break;
+            }
 
             case ATA_AIO_DMA:
@@ -5836 +5852 @@
 
             case ATA_AIO_PIO:
+            {
                 s = &pCtl->aIfs[pCtl->iAIOIf & ATA_SELECTED_IF_MASK]; /* Do not remove or there's an instant crash after loading the saved state */
 
-                if (s->iSourceSink != ATAFN_SS_NULL)
+                uint8_t const iSourceSink = s->iSourceSink;
+                if (   iSourceSink != ATAFN_SS_NULL
+                    && iSourceSink < RT_ELEMENTS(g_apfnSourceSinkFuncs))
                 {
                     bool fRedo;
                     Log2(("%s: Ctl#%d: calling source/sink function\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
-                    fRedo = g_apfnSourceSinkFuncs[s->iSourceSink](s);
+                    fRedo = g_apfnSourceSinkFuncs[iSourceSink](s);
                     pCtl->fRedo = fRedo;
                     if (RT_UNLIKELY(fRedo && !pCtl->fReset))
@@ -5856 +5875 @@
                 {
                     /* Continue a previously started transfer. */
+                    Assert(iSourceSink == ATAFN_SS_NULL);
                     ataUnsetStatus(s, ATA_STAT_BUSY);
                     ataSetStatus(s, ATA_STAT_READY);
@@ -5905 +5925 @@
                 }
                 break;
+            }
 
             case ATA_AIO_RESET_ASSERTED: