Changeset 76793 in vbox for trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c

Timestamp:

Jan 13, 2019 8:53:58 PM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

128131

Message:

3D: Validation of glDeleteQueries arguments

File:

• trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c (modified) (2 diffs)

trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c

@@ -10 +10 @@
 #include "server_dispatch.h"
 #include "server.h"
+#include "cr_unpack.h"
 
 void * SERVER_DISPATCH_APIENTRY
@@ -51 +52 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteBuffersARB( GLsizei n, const GLuint * buffer )
 {
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) || !DATA_POINTER_CHECK(n * sizeof(GLuint)))
+    {
+        crError("glDeleteBuffersARB: parameter 'n' is out of range");
+        return;
+    }
+
     crStateDeleteBuffersARB( n, buffer );
 }