vbox的更動 34667 路徑 trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp

時間撮記:

2010-12-2 下午11:08:24 (14 年 以前)

作者:

vboxsync

訊息:

Devices/Graphics: check requested screen sizes to be sure they fit in the available memory

檔案:

• trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp (修改) (3 筆差異)

trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp

@@ -1797 +1797 @@
 
             VBVAINFOSCREEN *pScreen = (VBVAINFOSCREEN *)pvBuffer;
+            int64_t cLastX = (int64_t)pScreen->u32Width + pScreen->i32OriginX;
+            int64_t cLastY = (int64_t)pScreen->u32Height + pScreen->i32OriginY;
+            VBVAINFOVIEW *pView = &pCtx->aViews[pScreen->u32ViewIndex].view;
+            /* Calculate the offsets of the beginning and the end of the screen
+             * so we can make sure they are inside the view.  We assume that
+             * screen rollover is not implemented. */
+            int64_t offBegin =   pScreen->i32OriginY * pScreen->u32LineSize
+                               +   pScreen->i32OriginX
+                                 * pScreen->u16BitsPerPixel / 8;
+            int64_t offEnd   =   cLastY * pScreen->u32LineSize
+                               + cLastX * pScreen->u16BitsPerPixel / 8;
             LogFlowFunc(("VBVA_INFO_SCREEN: [%d] @%d,%d %dx%d, line 0x%x, BPP %d, flags 0x%x\n",
                          pScreen->u32ViewIndex, pScreen->i32OriginX, pScreen->i32OriginY,
@@ -1802 +1813 @@
                          pScreen->u32LineSize,  pScreen->u16BitsPerPixel, pScreen->u16Flags));
 
-            if (pScreen->u32ViewIndex < RT_ELEMENTS (pCtx->aViews))
+            if (   pScreen->u32ViewIndex < RT_ELEMENTS (pCtx->aViews)
+                && pScreen->u16BitsPerPixel <= 32
+                && offBegin >= 0
+                && offEnd < pView->u32MaxScreenSize)
             {
                 vbvaResize (pVGAState, &pCtx->aViews[pScreen->u32ViewIndex], pScreen);
@@ -1808 +1822 @@
             else
             {
-                Log(("View index too large %d!!!\n",
-                     pScreen->u32ViewIndex));
+                Log(("VBVA_INFO_SCREEN [%lu]: bad data: @%ld,%ld %lux%lu, line 0x%lx, BPP %u, max screen size %lu\n",
+                         (unsigned long)pScreen->u32ViewIndex,
+                         (long)pScreen->i32OriginX,
+                         (long)pScreen->i32OriginY,
+                         (unsigned long)pScreen->u32Width,
+                         (unsigned long)pScreen->u32Height,
+                         (unsigned long)pScreen->u32LineSize,
+                         (unsigned long)pScreen->u16BitsPerPixel,
+                         (unsigned long)pView->u32MaxScreenSize));
                 rc = VERR_INVALID_PARAMETER;
             }