Changeset 98574 in vbox for trunk/include

Timestamp:

Feb 15, 2023 12:24:25 AM (2 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

155860

Message:

HGCMMock.h,tstGuestControlMockHGCM: Fixed memory overrun wrt client memory. Quick fix for use-after-free wrt call parameters (may still leak stuff because the code seems a bit uncertain about who does what). Disabled some non-working copy-paste tests.

File:

• trunk/include/VBox/GuestHost/HGCMMock.h (modified) (11 diffs)

trunk/include/VBox/GuestHost/HGCMMock.h

@@ -171 +171 @@
      *  0 is considered as being invalid. */
     HGCMCLIENTID       uNextClientId;
-    /** Size (in bytes) of opaque pvClient area to reserve
-     *  for a connected client. */
-    size_t             cbClient;
     /** Array of connected HGCM mock clients.
      *  Currently limited to 4 clients maximum. */
@@ -198 +195 @@
 
 /** Static HGCM service to mock. */
-static TSTHGCMMOCKSVC s_tstHgcmSvc;
+static TSTHGCMMOCKSVC g_tstHgcmSvc;
+
 
 /*********************************************************************************************************************************
@@ -206 +204 @@
 PTSTHGCMMOCKCLIENT TstHgcmMockSvcWaitForConnectEx(PTSTHGCMMOCKSVC pSvc, RTMSINTERVAL msTimeout);
 PTSTHGCMMOCKCLIENT TstHgcmMockSvcWaitForConnect(PTSTHGCMMOCKSVC pSvc);
-int                TstHgcmMockSvcCreate(PTSTHGCMMOCKSVC pSvc, size_t cbClient);
+int                TstHgcmMockSvcCreate(PTSTHGCMMOCKSVC pSvc);
 int                TstHgcmMockSvcDestroy(PTSTHGCMMOCKSVC pSvc);
 int                TstHgcmMockSvcStart(PTSTHGCMMOCKSVC pSvc);
@@ -281 +279 @@
     PTSTHGCMMOCKCLIENT pClient = &pSvc->aHgcmClient[pSvc->uNextClientId];
 
-    int rc = tstHgcmMockClientInit(pClient, pSvc->uNextClientId, pSvc->cbClient);
+    int rc = tstHgcmMockClientInit(pClient, pSvc->uNextClientId, pSvc->fnTable.cbClient);
     if (RT_FAILURE(rc))
         return rc;
@@ -349 +347 @@
     pFn->u.Call.hCall    = callHandle;
     pFn->u.Call.iFunc    = function;
-    pFn->u.Call.pParms   = (PVBOXHGCMSVCPARM)RTMemDup(paParms, cbParms);
+    PVBOXHGCMSVCPARM const paParmsCopy = (PVBOXHGCMSVCPARM)RTMemDup(paParms, cbParms);
+    pFn->u.Call.pParms   = paParmsCopy;
     AssertPtrReturn(pFn->u.Call.pParms, VERR_NO_MEMORY);
     pFn->u.Call.cParms   = cParms;
@@ -361 +360 @@
     AssertRCReturn(rc2, rc2);
 
-    memcpy(paParms, pFn->u.Call.pParms, cbParms);
+    memcpy(paParms, paParmsCopy, cbParms);
+    /** @todo  paParmsCopy is leaked, right? Doesn't appear to be a
+     *         use-after-free here. (pFn is freeded though) */
 
     return VINF_SUCCESS; /** @todo Return host call rc */
@@ -503 +504 @@
                     case TSTHGCMMOCKFNTYPE_CALL:
                     {
-                        pSvc->fnTable.pfnCall(NULL, pFn->u.Call.hCall, pFn->pClient->idClient, pFn->pClient->pvClient,
-                                              pFn->u.Call.iFunc, pFn->u.Call.cParms, pFn->u.Call.pParms, RTTimeMilliTS());
+                        pSvc->fnTable.pfnCall(pSvc->fnTable.pvService, pFn->u.Call.hCall, pFn->pClient->idClient,
+                                              pFn->pClient->pvClient, pFn->u.Call.iFunc, pFn->u.Call.cParms,
+                                              pFn->u.Call.pParms, RTTimeNanoTS());
 
                         /* Note: Call will be completed in the call completion callback. */
@@ -512 +514 @@
                     case TSTHGCMMOCKFNTYPE_HOST_CALL:
                     {
-                        pSvc->rcHostCall = pSvc->fnTable.pfnHostCall(NULL, pFn->u.HostCall.iFunc, pFn->u.HostCall.cParms, pFn->u.HostCall.pParms);
+                        pSvc->rcHostCall = pSvc->fnTable.pfnHostCall(pSvc->fnTable.pvService, pFn->u.HostCall.iFunc,
+                                                                     pFn->u.HostCall.cParms, pFn->u.HostCall.pParms);
 
                         int rc2 = RTSemEventSignal(pSvc->hEventHostCall);
@@ -544 +547 @@
 PTSTHGCMMOCKSVC TstHgcmMockSvcInst(void)
 {
-    return &s_tstHgcmSvc;
+    return &g_tstHgcmSvc;
 }
 
@@ -581 +584 @@
  * @return VBox status code.
  * @param  pSvc                 HGCM mock service instance to create.
- * @param  cbClient             Size (in bytes) of service-specific client data to
- *                              allocate for a HGCM mock client.
- */
-int TstHgcmMockSvcCreate(PTSTHGCMMOCKSVC pSvc, size_t cbClient)
-{
-    AssertReturn(cbClient, VERR_INVALID_PARAMETER);
-
+ */
+int TstHgcmMockSvcCreate(PTSTHGCMMOCKSVC pSvc)
+{
     RT_ZERO(pSvc->aHgcmClient);
     pSvc->fShutdown = false;
@@ -600 +599 @@
             {
                 RTListInit(&pSvc->lstCall);
-
-                pSvc->cbClient = cbClient;
             }
         }