Changeset 90774 in vbox

Timestamp:

Aug 23, 2021 5:59:57 AM (3 years ago)

Author:

vboxsync

Message:

Add guards to Load Exec function and replicated fix from r145659 in virtio 1.0. See BugRef(8651) Comment #109

File:

• trunk/src/VBox/Devices/Network/DevVirtioNet_1_0.cpp (modified) (8 diffs)

trunk/src/VBox/Devices/Network/DevVirtioNet_1_0.cpp

@@ -131 +131 @@
 #endif
 
+#define VIRTIONET_MAX_WORKERS           VIRTIONET_MAX_QPAIRS
 #define VIRTIONET_MAX_VIRTQS            (VIRTIONET_MAX_QPAIRS * 2 + 1)
 #define VIRTIONET_MAX_FRAME_SIZE        65535 + 18  /**< Max IP pkt size + Eth. header w/VLAN tag  */
@@ -480 +481 @@
 
     /** The device instance.
-     * @note This is _only_ for use when dealing with interface callbacks. */
+     * @note This is _only_ for use whxen dealing with interface callbacks. */
     PPDMDEVINSR3                    pDevIns;
 
@@ -1075 +1076 @@
 
     pHlp->pfnSSMGetU16(     pSSM, &pThis->cVirtVirtqs);
+    AssertReturn(pThis->cVirtVirtqs <= (VIRTIONET_MAX_QPAIRS * 2), VERR_OUT_OF_RANGE);
+
     pHlp->pfnSSMGetU16(     pSSM, &pThis->cWorkers);
+    AssertReturn(pThis->cWorkers <= VIRTIONET_MAX_WORKERS, VERR_OUT_OF_RANGE);
+
 
     for (int uVirtqNbr = 0; uVirtqNbr < pThis->cVirtVirtqs; uVirtqNbr++)
@@ -1110 +1115 @@
 
         pHlp->pfnSSMGetU32(     pSSM, &pThis->cMulticastFilterMacs);
+        AssertReturn(pThis->cMulticastFilterMacs <= VIRTIONET_MAC_FILTER_LEN, VERR_OUT_OF_RANGE);
         pHlp->pfnSSMGetMem(     pSSM, pThis->aMacMulticastFilter, pThis->cMulticastFilterMacs * sizeof(RTMAC));
 
@@ -1117 +1123 @@
 
         pHlp->pfnSSMGetU32(     pSSM, &pThis->cUnicastFilterMacs);
+        AssertReturn(pThis->cWorkers <= VIRTIONET_MAC_FILTER_LEN, VERR_OUT_OF_RANGE);
         pHlp->pfnSSMGetMem(     pSSM, pThis->aMacUnicastFilter, pThis->cUnicastFilterMacs * sizeof(RTMAC));
 
@@ -2280 +2287 @@
         return;
 
+
     if (!pThis->fVirtioReady)
     {
@@ -2292 +2300 @@
         return;
     }
+
 
     PPDMINETWORKUP pDrv = pThisCC->pDrv;
@@ -2771 +2780 @@
 
             Assert(pWorker->uIdx == uVirtqNbr);
+            RT_NOREF(pWorker);
+
             Assert(pVirtq->uIdx == pWorker->uIdx);