Changeset 83558 in vbox for trunk/src

Timestamp:

Apr 4, 2020 11:35:03 PM (5 years ago)

Author:

vboxsync

Message:

VMMDev: Adjusted RTMemFreeZ use - must use our private pGuestParm->u.ptr.cbData member not the pHostParm->u.pointer.size one as it can have been modified by the HGCM service. bugref:9698

File:

• trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp (modified) (4 diffs)

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp

@@ -351 +351 @@
                 VBOXHGCMGUESTPARM * const pGuestParm = &pCmd->u.call.paGuestParms[i];
 
-                if (pHostParm->type == VBOX_HGCM_SVC_PARM_PTR)
-                    RTMemFreeZ(pHostParm->u.pointer.addr, pHostParm->u.pointer.size);
-
                 if (   pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_In
                     || pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_Out
@@ -360 +357 @@
                     || pGuestParm->enmType == VMMDevHGCMParmType_ContiguousPageList)
                 {
+                    Assert(pHostParm->type == VBOX_HGCM_SVC_PARM_PTR);
                     if (pGuestParm->u.ptr.paPages != &pGuestParm->u.ptr.GCPhysSinglePage)
                         RTMemFree(pGuestParm->u.ptr.paPages);
+                    RTMemFreeZ(pHostParm->u.pointer.addr, pGuestParm->u.ptr.cbData);
+                }
+                else if (pGuestParm->enmType == VMMDevHGCMParmType_Embedded)
+                {
+                    Assert(pHostParm->type == VBOX_HGCM_SVC_PARM_PTR);
+                    RTMemFreeZ(pHostParm->u.pointer.addr, pGuestParm->u.ptr.cbData);
                 }
                 else if (pGuestParm->enmType == VMMDevHGCMParmType_NoBouncePageList)
                 {
+                    Assert(pHostParm->type == VBOX_HGCM_SVC_PARM_PAGES);
                     if (pGuestParm->u.Pages.paPgLocks)
                     {
@@ -374 +379 @@
                     }
                 }
+                else
+                    Assert(pHostParm->type != VBOX_HGCM_SVC_PARM_PTR && pHostParm->type != VBOX_HGCM_SVC_PARM_PAGES);
             }
         }
@@ -707 +714 @@
 
             case VMMDevHGCMParmType_PageList:
-                RT_FALL_THRU();
             case VMMDevHGCMParmType_LinAddr_In:
             case VMMDevHGCMParmType_LinAddr_Out: