Changeset 49846 in vbox

Timestamp:

Dec 9, 2013 3:41:02 PM (11 years ago)

Author:

vboxsync

Message:

HGCM: check size.

Location:

trunk

Files:

• include/VBox/VMMDev.h (modified) (1 diff)
• src/VBox/Devices/VMMDev/VMMDevHGCM.cpp (modified) (4 diffs)

trunk/include/VBox/VMMDev.h

@@ -119 +119 @@
 /** Maximum number of HGCM parameters. */
 #define VMMDEV_MAX_HGCM_PARMS               1024
+/** Maximum total size of hgcm buffers in one call. */
+#define VMMDEV_MAX_HGCM_DATA_SIZE           UINT32_C(0x7FFFFFFF)
 
 /**

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp

@@ -686 +686 @@
                     {
                         /* Only pointers with some actual data are counted. */
+                        if (pGuestParm->u.Pointer.size > VMMDEV_MAX_HGCM_DATA_SIZE - cbCmdSize)
+                        {
+                            rc = VERR_INVALID_PARAMETER;
+                            break;
+                        }
+
                         cbCmdSize += pGuestParm->u.Pointer.size;
 
@@ -699 +705 @@
                 case VMMDevHGCMParmType_PageList:
                 {
+                    if (pGuestParm->u.PageList.size > VMMDEV_MAX_HGCM_DATA_SIZE - cbCmdSize)
+                    {
+                        rc = VERR_INVALID_PARAMETER;
+                        break;
+                    }
+
                     cbCmdSize += pGuestParm->u.PageList.size;
                     Log(("vmmdevHGCMCall: pagelist size = %d\n", pGuestParm->u.PageList.size));
@@ -738 +750 @@
                     {
                         /* Only pointers with some actual data are counted. */
+                        if (pGuestParm->u.Pointer.size > VMMDEV_MAX_HGCM_DATA_SIZE - cbCmdSize)
+                        {
+                            rc = VERR_INVALID_PARAMETER;
+                            break;
+                        }
+
                         cbCmdSize += pGuestParm->u.Pointer.size;
 
@@ -751 +769 @@
                 case VMMDevHGCMParmType_PageList:
                 {
+                    if (pGuestParm->u.PageList.size > VMMDEV_MAX_HGCM_DATA_SIZE - cbCmdSize)
+                    {
+                        rc = VERR_INVALID_PARAMETER;
+                        break;
+                    }
+
                     cbCmdSize += pGuestParm->u.PageList.size;
                     Log(("vmmdevHGCMCall: pagelist size = %d\n", pGuestParm->u.PageList.size));