From nobody Wed Aug 26 18:57:40 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1779371874; cv=none; d=zohomail.com; s=zohoarc; b=UNM6Jh7VzK0Qgfd1pzOMZUqq4kp3hkd7FKI4Miz9fzfy4s+8cv2ZcWBr87ttgeN3fMbXVitPMYrWNU/Em3Al6VpPS/dB1syUYeTiz8aKaZFGtaati/D3jYenDIQEXiZVzSgKBmg3N+e0E0HCQ1gtOJb6u6G6xUAgKh96T125hkM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779371874; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ozfM5pL0zGVFmVkgCjhOy/HxIy8dJ9DpdHwS2nKdBUE=; b=U9BAwyQ18B/bxtMny67Q6ZqT2hxr2bKghUOJYftqq/bHZFqoJNIEW60fusYL7V2XHvuF9W2az3o9Zn8EKjXe1miiFA99cTHvO0PJrR0/Yi/t1TTKxdLPzJxfRzqwL2bXPtqshmWgBkJhjTSTZdMVIa65F8vjzg5bYKyfKQtK2H0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779371874053835.364784522282; Thu, 21 May 2026 06:57:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQ3tE-0007il-Kf; Thu, 21 May 2026 09:56:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ3tA-0007BO-7x for qemu-devel@nongnu.org; Thu, 21 May 2026 09:56:40 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ3t8-0000lv-Og for qemu-devel@nongnu.org; Thu, 21 May 2026 09:56:39 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-627-PZicMMnwMdWrvDQBrLlQIw-1; Thu, 21 May 2026 09:56:34 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D99751800622; Thu, 21 May 2026 13:56:32 +0000 (UTC) Received: from localhost (unknown [10.44.24.26]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id DEFEB300019F; Thu, 21 May 2026 13:56:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779371798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ozfM5pL0zGVFmVkgCjhOy/HxIy8dJ9DpdHwS2nKdBUE=; b=bPi4pRIRhPD3qmYuPydE7qezt5dXDsiCtYJ8cRDQ7YcswIyQUQCiMXmmSCknVJMJA1Ap4R p4Nyxvo3Rb9i8sR7pQwikBdf4CobvgSv4CEalQQ/PFRkYj7eOf+vVALVIyNJuW4HqsFk3t bT8Qa5jUFq0IRqEnp0kwrCI48oQNRU0= X-MC-Unique: PZicMMnwMdWrvDQBrLlQIw-1 X-Mimecast-MFC-AGG-ID: PZicMMnwMdWrvDQBrLlQIw_1779371793 From: marcandre.lureau@redhat.com To: qemu-devel@nongnu.org Cc: stefanha@gmail.com, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PULL v2 06/38] ui/vnc: fix OOB write in lossy rect worker code Date: Thu, 21 May 2026 17:55:17 +0400 Message-ID: <20260521135551.1752945-7-marcandre.lureau@redhat.com> In-Reply-To: <20260521135551.1752945-1-marcandre.lureau@redhat.com> References: <20260521135551.1752945-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1779371928082158500 From: Daniel P. Berrang=C3=A9 Incorrect calculation of the boundary condition when tracking lossy rectangles in the worker thread will result in an OOB write which can corrupt further worker state, and/or trigger any guard pages that may lie beyond the VncWorker struct. This can be triggered through careful choice of the display resolution in the guest OS by an unprivileged user. Fixes: CVE-2026-48002 Reported-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 Message-ID: <20260521103353.1645561-4-berrange@redhat.com> [Marc-Andr=C3=A9 - added assert() suggest by philmd@linaro.org] Signed-off-by: Marc-Andr=C3=A9 Lureau --- ui/vnc.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 56dd43d53ff..375ab207950 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2982,13 +2982,15 @@ void vnc_sent_lossy_rect(VncWorker *worker, int x, = int y, int w, int h) { int i, j; =20 - w =3D (x + w) / VNC_STAT_RECT; - h =3D (y + h) / VNC_STAT_RECT; + w =3D DIV_ROUND_UP((x + w), VNC_STAT_RECT); + h =3D DIV_ROUND_UP((y + h), VNC_STAT_RECT); + assert(h <=3D VNC_STAT_ROWS); + assert(w <=3D VNC_STAT_COLS); x /=3D VNC_STAT_RECT; y /=3D VNC_STAT_RECT; =20 - for (j =3D y; j <=3D h; j++) { - for (i =3D x; i <=3D w; i++) { + for (j =3D y; j < h; j++) { + for (i =3D x; i < w; i++) { worker->lossy_rect[j][i] =3D 1; } } --=20 2.54.0