Changeset 87110 in vbox for trunk/src/VBox/Devices/Graphics

Timestamp:

Dec 21, 2020 1:29:10 PM (4 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

141976

Message:

3D/VMSVGA: Ignore a surface in case of inconsistent parameters, bugref:9880

File:

• trunk/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp (modified) (6 diffs)

trunk/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp

@@ -92 +92 @@
 
     RT_ZERO(*pSurface);
-    pSurface->id                    = sid;
+    pSurface->id = SVGA3D_INVALID_ID; /* Keep this value until the surface init completes */
 #ifdef VMSVGA3D_OPENGL
     pSurface->idWeakContextAssociation = SVGA3D_INVALID_ID;
@@ -204 +204 @@
     uint32_t cbMemRemaining = SVGA3D_MAX_SURFACE_MEM_SIZE; /* Do not allow more than this for a surface. */
     SVGA3dSize mipmapSize = *pMipLevel0Size;
+    int rc = VINF_SUCCESS;
+
     for (uint32_t i = 0; i < numMipLevels; ++i)
     {
@@ -230 +232 @@
             }
 
-            AssertReturn(cBlocksX > 0 && cBlocksY > 0 && mipmapSize.depth > 0, VERR_INVALID_PARAMETER);
+            AssertBreakStmt(cBlocksX > 0 && cBlocksY > 0 && mipmapSize.depth > 0, rc = VERR_INVALID_PARAMETER);
 
             const uint32_t cMaxBlocksX = cbMemRemaining / pSurface->cbBlock;
-            if (cBlocksX > cMaxBlocksX)
-                return VERR_INVALID_PARAMETER;
+            AssertBreakStmt(cBlocksX < cMaxBlocksX, rc = VERR_INVALID_PARAMETER);
+
             const uint32_t cbSurfacePitch = pSurface->cbBlock * cBlocksX;
             LogFunc(("cbSurfacePitch=0x%x\n", cbSurfacePitch));
 
             const uint32_t cMaxBlocksY = cbMemRemaining / cbSurfacePitch;
-            if (cBlocksY > cMaxBlocksY)
-                return VERR_INVALID_PARAMETER;
+            AssertBreakStmt(cBlocksY < cMaxBlocksY, rc = VERR_INVALID_PARAMETER);
+
             const uint32_t cbSurfacePlane = cbSurfacePitch * cBlocksY;
 
             const uint32_t cMaxDepth = cbMemRemaining / cbSurfacePlane;
-            if (mipmapSize.depth > cMaxDepth)
-                return VERR_INVALID_PARAMETER;
+            AssertBreakStmt(mipmapSize.depth < cMaxDepth, rc = VERR_INVALID_PARAMETER);
+
             const uint32_t cbSurface = cbSurfacePlane * mipmapSize.depth;
 
@@ -261 +263 @@
         }
 
+        AssertRCBreak(rc);
+
         mipmapSize.width >>= 1;
         if (mipmapSize.width == 0) mipmapSize.width = 1;
@@ -268 +272 @@
         if (mipmapSize.depth == 0) mipmapSize.depth = 1;
     }
+
+    AssertLogRelRCReturnStmt(rc, RTMemFree(pSurface->paMipmapLevels), rc);
 
 #ifdef VMSVGA3D_DIRECT3D
@@ -315 +321 @@
         AssertReturn(pMipmapLevel->pSurfaceData, VERR_NO_MEMORY);
     }
+
+    pSurface->id = sid;
     return VINF_SUCCESS;
 }