diff options
| author | Michael Meskes <meskes@debian.org> | 2009-11-19 17:48:11 +0100 |
|---|---|---|
| committer | Michael Meskes <meskes@debian.org> | 2009-11-19 17:48:11 +0100 |
| commit | fd892711c6bdc0ef96b6b3ea13b668cb2a38196e (patch) | |
| tree | e6ec126da2bcd6a490d5661118630edf983580ec /src/VBox/Additions/linux/module/vboxmod.c | |
| parent | 8dc3a7e38d0783262b1aa8c3462e7359d8996d98 (diff) | |
| parent | b35715c68a1bec309bc1990353e35c20a21d5c47 (diff) | |
| download | virtualbox-debian/3.0.10-dfsg-2bpo50+1.tar.gz | |
Merge branch 'master' into lennydebian/3.0.10-dfsg-2bpo50+1
Conflicts:
debian/changelog
Diffstat (limited to 'src/VBox/Additions/linux/module/vboxmod.c')
| -rw-r--r-- | src/VBox/Additions/linux/module/vboxmod.c | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/src/VBox/Additions/linux/module/vboxmod.c b/src/VBox/Additions/linux/module/vboxmod.c index f911b7e72..ca60f2d67 100644 --- a/src/VBox/Additions/linux/module/vboxmod.c +++ b/src/VBox/Additions/linux/module/vboxmod.c @@ -832,6 +832,21 @@ static int vboxadd_ioctl(struct inode *inode, struct file *filp, } if (0 == rc) { + rc = VbglGRVerify(&reqHeader, cbRequestSize); + if (RT_FAILURE(rc)) + { + Log(("VBOXGUEST_IOCTL_VMMREQUEST: invalid request header: size %d min: %d type: %d rc: %d\n", + cbRequestSize, + cbVanillaRequestSize, + reqHeader.requestType, + rc)); + rc = -EINVAL; + } + else + rc = 0; + } + if (0 == rc) + { /* request storage for the full request */ rc = VbglGRAlloc(&reqFull, cbRequestSize, reqHeader.requestType); if (RT_FAILURE(rc)) @@ -1028,6 +1043,21 @@ static int vboxuser_ioctl(struct inode *inode, struct file *filp, } if (0 == rc) { + rc = VbglGRVerify(&reqHeader, cbRequestSize); + if (RT_FAILURE(rc)) + { + Log(("VBOXGUEST_IOCTL_VMMREQUEST: invalid request header: size %d min: %d type: %d rc: %d\n", + cbRequestSize, + cbVanillaRequestSize, + reqHeader.requestType, + rc)); + rc = -EINVAL; + } + else + rc = 0; + } + if (0 == rc) + { /* request storage for the full request */ rc = VbglGRAlloc(&reqFull, cbRequestSize, reqHeader.requestType); if (RT_FAILURE(rc)) |