Changeset 71903 in vbox for trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c

Timestamp:

Apr 18, 2018 4:22:34 PM (7 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

122141

Message:

3D: bugref:9096, Chromium code cleanup

File:

• trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c (modified) (2 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c

@@ -43 +43 @@
         GLuint index = READ_DATA(12, GLuint);
         GLuint num = READ_DATA(16, GLuint);
-        GLdouble *params = (GLdouble *) crAlloc(num * 4 * sizeof(GLdouble));
+    GLdouble *params;
+
+    if (num >= UINT32_MAX / (4 * sizeof(GLdouble)))
+    {
+        crError("crUnpackExtendProgramParameters4dvNV: parameter 'num' is out of range");
+        return;
+    }
+
+    params = (GLdouble *)crAlloc(num * 4 * sizeof(GLdouble));
+
         if (params) {
                 GLuint i;
                 for (i = 0; i < 4 * num; i++) {
-                        params[i] = READ_DATA(20 + i * 8, GLdouble);
+            params[i] = READ_DATA(20 + i * sizeof(GLdouble), GLdouble);
                 }
                 cr_unpackDispatch.ProgramParameters4dvNV(target, index, num, params);
@@ -60 +69 @@
         GLuint index = READ_DATA(12, GLuint);
         GLuint num = READ_DATA(16, GLuint);
-        GLfloat *params = (GLfloat *) crAlloc(num * 4 * sizeof(GLfloat));
+    GLfloat *params;
+
+    if (num >= UINT32_MAX / (4 * sizeof(GLfloat)))
+    {
+        crError("crUnpackExtendProgramParameters4fvNV: parameter 'num' is out of range");
+        return;
+    }
+
+    params = (GLfloat *)crAlloc(num * 4 * sizeof(GLfloat));
+
         if (params) {
                 GLuint i;
                 for (i = 0; i < 4 * num; i++) {
-                        params[i] = READ_DATA(20 + i * 4, GLfloat);
+            params[i] = READ_DATA(20 + i * sizeof(GLfloat), GLfloat);
                 }
                 cr_unpackDispatch.ProgramParameters4fvNV(target, index, num, params);