diff options
Diffstat (limited to 'src/VBox/Additions/linux/module/vboxmod.c')
| -rw-r--r-- | src/VBox/Additions/linux/module/vboxmod.c | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/src/VBox/Additions/linux/module/vboxmod.c b/src/VBox/Additions/linux/module/vboxmod.c index f911b7e72..ca60f2d67 100644 --- a/src/VBox/Additions/linux/module/vboxmod.c +++ b/src/VBox/Additions/linux/module/vboxmod.c @@ -832,6 +832,21 @@ static int vboxadd_ioctl(struct inode *inode, struct file *filp, } if (0 == rc) { + rc = VbglGRVerify(&reqHeader, cbRequestSize); + if (RT_FAILURE(rc)) + { + Log(("VBOXGUEST_IOCTL_VMMREQUEST: invalid request header: size %d min: %d type: %d rc: %d\n", + cbRequestSize, + cbVanillaRequestSize, + reqHeader.requestType, + rc)); + rc = -EINVAL; + } + else + rc = 0; + } + if (0 == rc) + { /* request storage for the full request */ rc = VbglGRAlloc(&reqFull, cbRequestSize, reqHeader.requestType); if (RT_FAILURE(rc)) @@ -1028,6 +1043,21 @@ static int vboxuser_ioctl(struct inode *inode, struct file *filp, } if (0 == rc) { + rc = VbglGRVerify(&reqHeader, cbRequestSize); + if (RT_FAILURE(rc)) + { + Log(("VBOXGUEST_IOCTL_VMMREQUEST: invalid request header: size %d min: %d type: %d rc: %d\n", + cbRequestSize, + cbVanillaRequestSize, + reqHeader.requestType, + rc)); + rc = -EINVAL; + } + else + rc = 0; + } + if (0 == rc) + { /* request storage for the full request */ rc = VbglGRAlloc(&reqFull, cbRequestSize, reqHeader.requestType); if (RT_FAILURE(rc)) |