Changeset 83617 in vbox for trunk/src/VBox

Timestamp:

Apr 8, 2020 9:21:02 AM (5 years ago)

Author:

vboxsync

Message:

VUSB: Avoid too large URBs (see bugref:9697).

Location:

trunk/src/VBox/Devices/USB

Files:

• DrvVUSBRootHub.cpp (modified) (1 diff)
• VUSBUrb.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/USB/DrvVUSBRootHub.cpp

@@ -380 +380 @@
     RT_NOREF(pszTag);
     PVUSBURBPOOL pUrbPool = &pRh->Hub.Dev.UrbPool;
+
+    if (RT_UNLIKELY(cbData > (32 * _1M)))
+    {
+        LogFunc(("Bad URB size (%u)!\n", cbData));
+        return NULL;
+    }
 
     if (!pDev)

trunk/src/VBox/Devices/USB/VUSBUrb.cpp

@@ -703 +703 @@
     if (pExtra->cbMax < cbBuf + pSetupIn->wLength + sizeof(VUSBURBVUSBINT))
     {
+#if 1
+        LogRelMax(10, ("VUSB: Control URB too large (wLength=%u)!\n", pSetupIn->wLength));
+        return false;
+#else
         uint32_t cbReq = RT_ALIGN_32(cbBuf + pSetupIn->wLength + sizeof(VUSBURBVUSBINT), 1024);
         PVUSBCTRLEXTRA pNew = (PVUSBCTRLEXTRA)RTMemRealloc(pExtra, RT_UOFFSETOF_DYN(VUSBCTRLEXTRA, Urb.abData[cbReq]));
@@ -717 +721 @@
             pPipe->pCtrl = pExtra;
         }
+
+        PVUSBURBVUSB pOldVUsb = (PVUSBURBVUSB)&pExtra->Urb.abData[pExtra->cbMax - sizeof(VUSBURBVUSBINT)];
         pExtra->Urb.pVUsb = (PVUSBURBVUSB)&pExtra->Urb.abData[cbBuf + pSetupIn->wLength];
+        memmove(pExtra->Urb.pVUsb, pOldVUsb, sizeof(VUSBURBVUSBINT));
+        memset(pOldVUsb, 0, (uint8_t *)pExtra->Urb.pVUsb - (uint8_t *)pOldVUsb);
         pExtra->Urb.pVUsb->pUrb = &pExtra->Urb;
+        pExtra->Urb.pVUsb->pvFreeCtx = &pExtra->Urb;
         pExtra->cbMax = cbReq;
+
+#endif
     }
     Assert(pExtra->Urb.enmState == VUSBURBSTATE_ALLOCATED);