vbox的更動 39603 路徑 trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp

時間撮記:

2011-12-14 上午11:12:56 (13 年 以前)

作者:

vboxsync

訊息:

crHgsmi: cleanup

檔案:

• trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp (修改) (2 筆差異)

trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp

@@ -1657 +1657 @@
         case VBVA_VDMA_CMD:
         {
+            if (cbBuffer < VBoxSHGSMIBufferHeaderSize() + sizeof (VBOXVDMACBUF_DR))
+            {
+                rc = VERR_INVALID_PARAMETER;
+                break;
+            }
             PVBOXVDMACBUF_DR pCmd = (PVBOXVDMACBUF_DR)VBoxSHGSMIBufferData ((PVBOXSHGSMIHEADER)pvBuffer);
-            vboxVDMACommand(pVGAState->pVdma, pCmd);
+            vboxVDMACommand(pVGAState->pVdma, pCmd, cbBuffer - VBoxSHGSMIBufferHeaderSize());
             rc = VINF_SUCCESS;
             break;
@@ -1664 +1669 @@
         case VBVA_VDMA_CTL:
         {
+            if (cbBuffer < VBoxSHGSMIBufferHeaderSize() + sizeof (VBOXVDMA_CTL))
+            {
+                rc = VERR_INVALID_PARAMETER;
+                break;
+            }
             PVBOXVDMA_CTL pCmd = (PVBOXVDMA_CTL)VBoxSHGSMIBufferData ((PVBOXSHGSMIHEADER)pvBuffer);
-            vboxVDMAControl(pVGAState->pVdma, pCmd);
+            vboxVDMAControl(pVGAState->pVdma, pCmd, cbBuffer - VBoxSHGSMIBufferHeaderSize());
             rc = VINF_SUCCESS;
             break;