Changeset 85145 in vbox for trunk/src/VBox/HostServices

Timestamp:

Jul 9, 2020 9:59:22 AM (5 years ago)

Author:

vboxsync

Message:

DnD/HostService: Improved verification of DragAndDropService::guestCall(). bugref:9777.

File:

• trunk/src/VBox/HostServices/DragAndDrop/VBoxDragAndDropSvc.cpp (modified) (14 diffs)

trunk/src/VBox/HostServices/DragAndDrop/VBoxDragAndDropSvc.cpp

@@ -30 +30 @@
 #include <VBox/HostServices/Service.h>
 #include <VBox/HostServices/DragAndDropSvc.h>
+#include <VBox/AssertGuest.h>
 
 #include <VBox/err.h>
@@ -408 +409 @@
     }
 
+/* Verifies that an uint32 parameter has the expected buffer size set.
+ * Will set rc to VERR_INVALID_PARAMETER otherwise. See #9777. */
+#define VERIFY_BUFFER_SIZE_UINT32(a_ParmUInt32, a_SizeExpected) \
+{ \
+    uint32_t cbTemp = 0; \
+    rc = HGCMSvcGetU32(&a_ParmUInt32, &cbTemp); \
+    ASSERT_GUEST_STMT(RT_SUCCESS(rc) && cbTemp == a_SizeExpected, rc = VERR_INVALID_PARAMETER); \
+}
+
     if (rc == VINF_SUCCESS) /* Note: rc might be VINF_HGCM_ASYNC_EXECUTE! */
     {
@@ -557 +567 @@
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetPv(&paParms[1], (void **)&data.pszFormat, &data.cbFormat);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[2], &data.cbFormat);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[2], data.cbFormat);
                         }
                         break;
@@ -640 +649 @@
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetPv(&paParms[3], (void**)&data.pszFormat, &data.cbFormat);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[4], &data.cbFormat);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[4], data.cbFormat);
                         }
                         break;
@@ -684 +692 @@
                     if (RT_SUCCESS(rc))
                         rc = HGCMSvcGetPv(&paParms[5], &data.data.pvMetaFmt, &data.data.cbMetaFmt);
-                    if (RT_SUCCESS(rc))
-                        rc = HGCMSvcGetU32(&paParms[6], &data.data.cbMetaFmt);
+                    VERIFY_BUFFER_SIZE_UINT32(paParms[6], data.data.cbMetaFmt);
                     if (RT_SUCCESS(rc))
                         rc = HGCMSvcGetU64(&paParms[7], &data.data.cObjects);
@@ -694 +701 @@
                     if (RT_SUCCESS(rc))
                         rc = HGCMSvcGetPv(&paParms[10], &data.data.pvChecksum, &data.data.cbChecksum);
-                    if (RT_SUCCESS(rc))
-                        rc = HGCMSvcGetU32(&paParms[11], &data.data.cbChecksum);
-
+                    VERIFY_BUFFER_SIZE_UINT32(paParms[11], data.data.cbChecksum);
                     LogFlowFunc(("fFlags=0x%x, cbTotalSize=%RU64, cObj=%RU64\n",
                                  data.data.uFlags, data.data.cbTotal, data.data.cObjects));
@@ -718 +723 @@
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetPv(&paParms[1], (void**)&data.data.u.v3.pvData, &data.data.u.v3.cbData);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[2], &data.data.u.v3.cbData);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[2], data.data.u.v3.cbData);
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetPv(&paParms[3], (void**)&data.data.u.v3.pvChecksum, &data.data.u.v3.cbChecksum);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[4], &data.data.u.v3.cbChecksum);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[4], data.data.u.v3.cbChecksum);
                             DO_HOST_CALLBACK();
                         }
@@ -764 +767 @@
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetPv(&paParms[1], (void**)&data.pszPath, &data.cbPath);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[2], &data.cbPath);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[2], data.cbPath);
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetU32(&paParms[3], &data.fMode);
@@ -778 +780 @@
                         {
                             rc = HGCMSvcGetPv(&paParms[0], (void**)&data.pszPath, &data.cbPath);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[1], &data.cbPath);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[1], data.cbPath);
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetU32(&paParms[2], &data.fMode);
@@ -803 +804 @@
                     if (RT_SUCCESS(rc))
                         rc = HGCMSvcGetPv(&paParms[1], (void**)&data.pszFilePath, &data.cbFilePath);
-                    if (RT_SUCCESS(rc))
-                        rc = HGCMSvcGetU32(&paParms[2], &data.cbFilePath);
+                    VERIFY_BUFFER_SIZE_UINT32(paParms[2], data.cbFilePath);
                     if (RT_SUCCESS(rc))
                         rc = HGCMSvcGetU32(&paParms[3], &data.fFlags);
@@ -836 +836 @@
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetPv(&paParms[1], (void**)&data.pvData, &data.cbData);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[2], &data.cbData);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[2], data.cbData);
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetPv(&paParms[3], (void**)&data.u.v3.pvChecksum, &data.u.v3.cbChecksum);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[4], &data.u.v3.cbChecksum);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[4], data.u.v3.cbChecksum);
 
                             LogFlowFunc(("pvData=0x%p, cbData=%RU32\n", data.pvData, data.cbData));
@@ -859 +857 @@
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetPv(&paParms[1], (void**)&data.pvData, &data.cbData);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[2], &data.cbData);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[2], data.cbData);
 
                             LogFlowFunc(("cbData=%RU32, pvData=0x%p\n", data.cbData, data.pvData));
@@ -875 +872 @@
                             RT_ZERO(data);
                             data.hdr.uMagic = CB_MAGIC_DND_GH_SND_FILE_DATA;
-                            uint32_t cTmp;
-                            rc = HGCMSvcGetPv(&paParms[0], (void**)&data.u.v1.pszFilePath, &cTmp);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[1], &data.u.v1.cbFilePath);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetPv(&paParms[2], (void**)&data.pvData, &cTmp);
-                            if (RT_SUCCESS(rc))
-                                rc = HGCMSvcGetU32(&paParms[3], &data.cbData);
+                            rc = HGCMSvcGetPv(&paParms[0], (void**)&data.u.v1.pszFilePath, &data.u.v1.cbFilePath);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[1], data.u.v1.cbFilePath);
+                            if (RT_SUCCESS(rc))
+                                rc = HGCMSvcGetPv(&paParms[2], (void**)&data.pvData, &data.cbData);
+                            VERIFY_BUFFER_SIZE_UINT32(paParms[3], data.cbData);
                             if (RT_SUCCESS(rc))
                                 rc = HGCMSvcGetU32(&paParms[4], &data.u.v1.fMode);
@@ -982 +976 @@
         }
     }
+
+#undef VERIFY_BUFFER_SIZE_UINT32
 
     /*