Changeset 96950 in vbox for trunk/src/VBox/Devices/Graphics

Timestamp:

Sep 30, 2022 10:19:06 AM (2 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

153861

Message:

Devices/Graphics: Some old Xorg servers apparently in collaboration with
old versions of GNOME can send window coordinates with a negative height
value via SVGA_CMD_UPDATE which ends up as an index array in subsequent
VBox code. Drop such invalid updates in vmsvgaR3UpdateScreen() as is
done similarly elsewhere (and assert(3C) if enabled). bugref:10292

File:

• trunk/src/VBox/Devices/Graphics/DevVGA-SVGA.cpp (modified) (1 diff)

trunk/src/VBox/Devices/Graphics/DevVGA-SVGA.cpp

@@ -1646 +1646 @@
 {
     VBVACMDHDR cmd;
+
+    ASSERT_GUEST_LOGREL_MSG_RETURN(w > 0 && h > 0,
+                                   ("vmsvgaR3UpdateScreen: screen %d (%d,%d) %dx%d: Invalid height and/or width supplied.\n",
+                                   pScreen->idScreen, x, y, w, h),
+                                   VERR_INVALID_PARAMETER);
+
     cmd.x = (int16_t)(pScreen->xOrigin + x);
     cmd.y = (int16_t)(pScreen->yOrigin + y);