Skip to content

VRDP: Fix incorrect index check in QueryClientMonitorRect#542

Open
ehdgks0627 wants to merge 1 commit intoVirtualBox:mainfrom
ehdgks0627:main
Open

VRDP: Fix incorrect index check in QueryClientMonitorRect#542
ehdgks0627 wants to merge 1 commit intoVirtualBox:mainfrom
ehdgks0627:main

Conversation

@ehdgks0627
Copy link

@ehdgks0627 ehdgks0627 commented Feb 9, 2026

Description

QueryClientMonitorRect uses > instead of >= to validate uScreenId, allowing an out-of-range access to m_paRects when the server has more monitors than the client reported. The adjacent IsScreenMatched already uses '>=' correctly.

Analysis

m_paRects is allocated with m_cMonitors elements (valid indices 0 to m_cMonitors - 1) in CalculateClientRect (line 662-686). When uScreenId == m_cMonitors, the guard passes and m_paRects[m_cMonitors] accesses past the array.

virtualbox/src/VBox/RDP/server/vrdpdmap.cpp

Lines 691 to 703 in 354a83f

/* virtual */ void VRDPClientDesktopMapMultiMon::QueryClientMonitorRect (unsigned uScreenId, RGNRECT *pRect)
{
if (uScreenId > m_cMonitors)
{
pRect->x = 0;
pRect->y = 0;
pRect->w = 0;
pRect->h = 0;
return;
}
*pRect = m_paRects[uScreenId];
}

@ehdgks0627
VRDP: Fix incorrect index check in QueryClientMonitorRect
1ff2681 
  QueryClientMonitorRect uses '>' instead of '>=' to validate
  uScreenId, allowing an out-of-range access to m_paRects when
  the server has more monitors than the client reported.
  The adjacent IsScreenMatched already uses '>=' correctly.
@oracle-contributor-agreement
Copy link

oracle-contributor-agreement bot commented Feb 9, 2026

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.

@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Required At least one contributor does not have an approved Oracle Contributor Agreement. label Feb 9, 2026
@oracle-contributor-agreement
Copy link

oracle-contributor-agreement bot commented Feb 10, 2026

Thank you for signing the OCA.

@oracle-contributor-agreement oracle-contributor-agreement bot added OCA Verified All contributors have signed the Oracle Contributor Agreement. and removed OCA Required At least one contributor does not have an approved Oracle Contributor Agreement. labels Feb 10, 2026
@alflr
Copy link
Contributor

alflr commented Feb 11, 2026

Thanks for the patch, but shouldn't this be uScreenId >= m_cMonitors (this is zero-based, so m_cMonitors - 1)?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

OCA Verified All contributors have signed the Oracle Contributor Agreement.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ehdgks0627 @alflr