Changeset 82662 in vbox for trunk/src/VBox/HostDrivers/VBoxUSB

Timestamp:

Jan 8, 2020 9:14:38 AM (5 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

135563

Message:

VBoxUSB: Use USBFilterIsMethodUsingStringValue() because USBFILTERMATCH_NUM_EXPRESSION uses a string value while not being a string field, some additional checks, @bugref{9622}

File:

• trunk/src/VBox/HostDrivers/VBoxUSB/USBFilter.cpp (modified) (3 diffs)

trunk/src/VBox/HostDrivers/VBoxUSB/USBFilter.cpp

@@ -327 +327 @@
     }
 
+    /* Validate that string value offsets are inside the string table. */
+    for (uint32_t i = 0; i < RT_ELEMENTS(pFilter->aFields); i++)
+    {
+        if (    USBFilterIsMethodUsingStringValue((USBFILTERMATCH)pFilter->aFields[i].enmMatch)
+            &&  pFilter->aFields[i].u16Value > pFilter->offCurEnd)
+        {
+            Log(("USBFilter: %p - bad offset=%#x\n", pFilter->aFields[i].u16Value));
+            return VERR_INVALID_PARAMETER;
+        }
+    }
+
     /*
      * Validate the string table.
@@ -350 +361 @@
         unsigned i;
         for (i = 0; i < RT_ELEMENTS(pFilter->aFields); i++)
-            if (    USBFilterIsMethodString((USBFILTERMATCH)pFilter->aFields[i].enmMatch)
+            if (    USBFilterIsMethodUsingStringValue((USBFILTERMATCH)pFilter->aFields[i].enmMatch)
                 &&  pFilter->aFields[i].u16Value == off)
                 break;
@@ -1791 +1802 @@
 
 /**
- * Checks if a matching method is for string fields or not.
+ * Checks if a matching method is for numeric fields or not.
  *
  * @returns true / false.