Changeset 85545 in vbox for trunk/src/VBox/HostDrivers/Support

Timestamp:

Jul 30, 2020 9:07:13 AM (4 years ago)

Author:

vboxsync

Message:

SUPDrv: Need to copy the segments before we call supdrvLdrValidatePointer. Made sure supdrvLdrValidatePointer found a matching executable segment. bugref:9801

File:

• trunk/src/VBox/HostDrivers/Support/SUPDrv.cpp (modified) (3 diffs)

trunk/src/VBox/HostDrivers/Support/SUPDrv.cpp

@@ -5255 +5255 @@
                                           pImage->paSegments[iSeg].fProt);
             }
+        if (iSeg >= pImage->cSegments)
+        {
+            supdrvLdrUnlock(pDevExt);
+            return supdrvLdrLoadError(VERR_INVALID_PARAMETER, pReq,
+                                      "Bad entry point %p given for %s: no matching segment found (RVA %#zx)!",
+                                      pv, pszSymbol, uRva);
+        }
 
         if (pImage->fNative)
@@ -5335 +5342 @@
     }
 
+    /*
+     * Copy the segments before we start using supdrvLdrValidatePointer for entrypoint validation.
+     */
+    pImage->cSegments = pReq->u.In.cSegments;
+    {
+        size_t  cbSegments = pImage->cSegments * sizeof(SUPLDRSEG);
+        pImage->paSegments = (PSUPLDRSEG)RTMemDup(&pReq->u.In.abImage[pReq->u.In.offSegments], cbSegments);
+        if (pImage->paSegments) /* Align the last segment size to avoid upsetting RTR0MemObjProtect. */ /** @todo relax RTR0MemObjProtect */
+            pImage->paSegments[pImage->cSegments - 1].cb = RT_ALIGN_32(pImage->paSegments[pImage->cSegments - 1].cb, PAGE_SIZE);
+        else
+        {
+            supdrvLdrUnlock(pDevExt);
+            return supdrvLdrLoadError(VERR_NO_MEMORY, pReq, "Out of memory for segment table: %#x", cbSegments);
+        }
+        SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
+    }
+
+    /*
+     * Validate entrypoints.
+     */
     switch (pReq->u.In.eEPType)
     {
@@ -5404 +5431 @@
             if (!pImage->paSymbols)
                 rc = supdrvLdrLoadError(VERR_NO_MEMORY, pReq, "Out of memory for symbol table: %#x", cbSymbols);
-            SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
-        }
-
-        pImage->cSegments = pReq->u.In.cSegments;
-        if (RT_SUCCESS(rc))
-        {
-            size_t  cbSegments = pImage->cSegments * sizeof(SUPLDRSEG);
-            pImage->paSegments = (PSUPLDRSEG)RTMemDup(&pReq->u.In.abImage[pReq->u.In.offSegments], cbSegments);
-            if (pImage->paSegments) /* Align the last segment size to avoid upsetting RTR0MemObjProtect. */ /** @todo relax RTR0MemObjProtect */
-                pImage->paSegments[pImage->cSegments - 1].cb = RT_ALIGN_32(pImage->paSegments[pImage->cSegments - 1].cb, PAGE_SIZE);
-            else
-                rc = supdrvLdrLoadError(VERR_NO_MEMORY, pReq, "Out of memory for segment table: %#x", cbSegments);
             SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
         }