From nobody Sun Jul 26 11:01:50 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783342510; cv=none; d=zohomail.com; s=zohoarc; b=XLqkFqycN9J0U4TJnWPPiN02YIYlaR01zqccn6Zmwhf29221m3t70PCke6yFTQuWrH8fMjJhJe8ltqkZwm8FT1nHexV9xmb6EQnH4aKUpnJxY2wfoLLTBdl4CO2z84AvEP4AbPmJnXQ/uKKbjGURbrZQpQk+/oEM6Xm7FzgSg/o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783342510; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mnMduQI4JzxWh7DFwl+Ge03blT1Jvh4bKa8/9Kbe0yI=; b=iPRb3MadkDGnRisTq9PETW0yjukGpqcLcxCGC1sKQMY7VMEWWUZB2183kaj/y288k9tmhm/Y6B/dikrQgJcQGa2y50MJqPdrm9ce/oCAV4MjLWuJyOzr2FR3wRM8VdFAGazezIiEI7umX/TsDFlPa4CcGWIvT9OYDFRheRCHE+w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783342510671156.48589877835434; Mon, 6 Jul 2026 05:55:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgiqE-0005uN-IN; Mon, 06 Jul 2026 08:54:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgipz-0005qq-Dn for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:18 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgipy-0007zF-2F for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:15 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-596-jJdAaHZJPySxLGTV_LBjCQ-1; Mon, 06 Jul 2026 08:54:12 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3072118052F9; Mon, 6 Jul 2026 12:54:11 +0000 (UTC) Received: from localhost (unknown [10.44.22.3]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1169836512; Mon, 6 Jul 2026 12:54:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783342453; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mnMduQI4JzxWh7DFwl+Ge03blT1Jvh4bKa8/9Kbe0yI=; b=TkDujxIZSTGhvI3Usrfv/T4z1Va8Lmtc4fxFdI6PWi6o6bn/WIOaQSgA/PR+CF+KQ+URm/ zgzg8cAe45GIe3vkx12BvbTQzAUKGn6Hs+KHfFpLYO5EA7rCpadePxhAYgkGAl8P+qihiL vX0XeO5fDcMGZGUrhE2BhynKnaCQMLo= X-MC-Unique: jJdAaHZJPySxLGTV_LBjCQ-1 X-Mimecast-MFC-AGG-ID: jJdAaHZJPySxLGTV_LBjCQ_1783342451 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Mon, 06 Jul 2026 16:53:48 +0400 Subject: [PATCH 1/5] i386/tdx: fix uninitialized variable warning in tdx_check_features MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260706-fix-v1-1-4b83a70e9f3b@redhat.com> References: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> In-Reply-To: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Marcelo Tosatti , kvm@vger.kernel.org, =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=902; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=Kjaz1rel2sNl+d5VT2IglyjxLokjkl6yFaJ2/HKSzoY=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqS6VnYhFFHkp+YuIdTnf12RCW5HTzJn2F8kIu0 UerFQ6AQPeJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCakulZwAKCRDa6OEJdZac 5XD3EACUpaHxCQl9UJsJGOh2BXvqFVl6jDj38+2BJRXkR90lAoyWnP1ovKmRtnOQM3/7mDXAaod lsJS4vGb1Y7Y8xF2l7IyfOmaVedA35VA2nggnoDwJVbJzALyvcDBtHuBvIpcs6Hd1vJl+6fANUi IDU1ovdjpHn39BlS4M5VjucnumTy5pfC2UZz1mi+sAy9Oijr31OX7bIB/7N28/AEdMBpjacFid/ YmLaA5Sch7P2AZzy3muspPSf4919k2nPABU4xvM3Fr5nKnYX7wa3GSf4SrpnOyGxTzHELAmqf0O ltlqDrdo/XevIXh1TkIAZzfhNVMiQDBVkWqo7e0ZqQnbs4a3G2gnch3hNrnfZtYi19KGOI6/tpG BLNxvvIqWtGlMlOXoPx+3lNrb/Bjy9wsuHg/GGnlvXzp/LUzcKw7HffIuBKT/8N/x71Bdw96Zzb LwzSZgvZj5B39lsb+TYPdoptEJJ02B2+rg/BCa0MAGPLags8qN5DVK/QexYoRw88ybl2o98MT78 Wc/kK8GdmX0DNnE9CqnXdDNZcSApCz6Fo8aHV7FNb6yf29dHecnd+dp2fMjKu6ZM+iLkH6dqPr/ kLko9KTWZnCGFN0RDMNeYRuxE3NoivcSlE5vKRAkkvu+hbYvnz7Npb19dwPdGFgWT6FyY9+kdjA Yi9b0qmwuvYoyww== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783342511843158500 tdx_fetch_cpuid() only sets the output ret parameter on the error path. GCC cannot prove that r is always initialized before use in the caller, triggering -Werror=3Dmaybe-uninitialized. Initialize r to -1 to silence the warning. Fixes: 228e40f33048 ("i386/tdx: Fetch and validate CPUID of TD guest") Signed-off-by: Marc-Andre Lureau Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- target/i386/kvm/tdx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c index c9c3b05d5fe..8294dbde3aa 100644 --- a/target/i386/kvm/tdx.c +++ b/target/i386/kvm/tdx.c @@ -887,7 +887,7 @@ static int tdx_check_features(X86ConfidentialGuest *cg,= CPUState *cs) FeatureWordInfo *wi; FeatureWord w; bool mismatch =3D false; - int r; + int r =3D -1; =20 fetch_cpuid =3D tdx_fetch_cpuid(cs, &r); if (!fetch_cpuid) { --=20 2.55.0 From nobody Sun Jul 26 11:01:50 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783342504; cv=none; d=zohomail.com; s=zohoarc; b=S1SKYCaL4OS2kMlYzS2v5ZyswMR6nVs5ZjeWyeBtonbB/1UM1chaHM07AkZMypf7bAMZVZvArZxAw2LgwzZ88NCM5NL21WKsqKAZE3Qjg6zE74HIo44GrYPHzDDf7jT9dgklkMYzDfS35gPDWLL7reS9GGxfpXTij8ApSyl6ei4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783342504; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=dvRhR53UrAzcMNlT2sX9FL22cxe12mJf+ORaQ6a9Dew=; b=YbNqTgYVIH3+AFo2DZ6KNiclfmN5owc+sdlrJ37526CoXKf2sDYONwk94rAN9d80+8P67k+6UCTmukmZixiQ5p0G5oqk2ca0wclxugPLsDQHmfvSPkI+QZyaNKeoN2TMBTTotfQSGeEf99pmK6OQZV6U5jwHiMh/6QodDYrNxA0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783342504054600.0374708576129; Mon, 6 Jul 2026 05:55:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgiqE-0005uV-LI; Mon, 06 Jul 2026 08:54:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgiq6-0005t1-GK for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:23 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgiq4-00082W-Ss for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:22 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-639-CD-Er2OzMd2O4nrWU9Rp9A-1; Mon, 06 Jul 2026 08:54:17 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1F3F318052E6; Mon, 6 Jul 2026 12:54:16 +0000 (UTC) Received: from localhost (unknown [10.44.22.3]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1056A36535; Mon, 6 Jul 2026 12:54:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783342460; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dvRhR53UrAzcMNlT2sX9FL22cxe12mJf+ORaQ6a9Dew=; b=haIHAPI4m4KwtJccZsLXA3D6sNM0VfCdHA6bNnH6z8wNaRV9mpsoCKVKCvewt5ALyrx67q DN7EI/ig3jej/6lZepiFSEtdVHeeQsgkZdo8Bazv28GFmvQnKvp1RZBVYdSap6cimr7q8S YU5NLm+sT2Td3BXS0BcFmBcHWu4Q0bQ= X-MC-Unique: CD-Er2OzMd2O4nrWU9Rp9A-1 X-Mimecast-MFC-AGG-ID: CD-Er2OzMd2O4nrWU9Rp9A_1783342456 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Mon, 06 Jul 2026 16:53:49 +0400 Subject: [PATCH 2/5] ui/vnc: fix OOB write in vnc_refresh_lossy_rect MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260706-fix-v1-2-4b83a70e9f3b@redhat.com> References: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> In-Reply-To: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Marcelo Tosatti , kvm@vger.kernel.org, =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=2003; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=Z78cz1W83ZCTre26QU2Eg5dadzpsa2kEeUScuSzoE8k=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqS6VnJqMo8xpRd7aCTIXw8rftrnufpHdZk70GQ NcvXcAz5uCJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCakulZwAKCRDa6OEJdZac 5VWwD/wNdwT+by3j0vD6hfUoiAHf+qx+2qluQ/ZF/ZMpTSOtz4Tj0jykZKVWIpDK89Wu+9dCqEr e50o42fTdpluHRybjJGujilk6kc6uzrLIQkE7XGi60S2bGFT93p7fzmZNHxCbbLbg/b7hSpqEzG dMDa76MH0QtWfzIH4VtZsB4rYxUrzNmlT+ZwVSZAHO8A0TulMTYFz7wrvNvAmRUG1+qL1Kqn0n3 6UlujHIIfA+InEnc0hR9vImHYK8rjfMrzl2XlrQvvEEo5U93Pbns2VMr4qH/s8NV9C2ACvzLA1A NwkVY2ax6zB/7BdamxK1sjgDxtqOQ5viWuYN7A683EbUnHqCiphuvDdtQ3V6A/KGvGFJnBr2GMp pnI7NHdc9ALUN9kCjNSaU+X8FEhWP3I/Z0pgiPmJ5gPUcxZ2NWyxvSflceG4TyRdM9M8ghJ+pKd sYpr4aPg48f12UCdyzxY2p5FYE9Gmd57rtxzsTyfyUQxEzss+47ExVCTTpFeLR/16FLgYKD4igL +AztFIZPiJZ/w6wdrkbySOEM69rDAAAAuhnuzSYQui1grlNHYOfhdIl5Fk9EIYLF2OsSvfpXW/C kWlhNuZhdw/RLDNy8QbKa3GjPYYjoAzSxJZrbsO6VpnRIoYfmTXmSnfQ+vKwDasIXHKx93Qvrbr kUErf1bw/IunfzQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783342505869158500 vnc_refresh_lossy_rect() always marks a full VNC_STAT_RECT (64) rows as dirty when refreshing a lossy tile. When the display height is not a multiple of VNC_STAT_RECT (e.g. VNC_MAX_HEIGHT =3D 2160), the bottom tile is partial -- the last tile at y=3D2112 has only 48 valid rows. The unclamped loop writes to vs->dirty[2160..2175], past the end of the VNC_MAX_HEIGHT-sized array. Clamp the row count to the actual surface height so partial bottom tiles only mark valid dirty bitmap entries. Fixes: CVE-2026-48002 Fixes: 7d964c9d2fc6 ("vnc: refresh lossy rect after a given timeout") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3950 Reported-by: huntr bubble Signed-off-by: Marc-Andre Lureau Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- ui/vnc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/ui/vnc.c b/ui/vnc.c index b2b69923b75..559d3954b87 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -3004,10 +3004,18 @@ static int vnc_refresh_lossy_rect(VncDisplay *vd, i= nt x, int y) int sty =3D y / VNC_STAT_RECT; int stx =3D x / VNC_STAT_RECT; int has_dirty =3D 0; + int height =3D MIN(pixman_image_get_height(vd->guest.fb), + pixman_image_get_height(vd->server)); + int rows; =20 y =3D QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); x =3D QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); =20 + rows =3D MIN(VNC_STAT_RECT, height - y); + if (rows <=3D 0) { + return 0; + } + QTAILQ_FOREACH(vs, &vd->clients, next) { VncConnection *vc =3D container_of(vs, VncConnection, vs); int j; @@ -3022,7 +3030,7 @@ static int vnc_refresh_lossy_rect(VncDisplay *vd, int= x, int y) } =20 vc->worker.lossy_rect[sty][stx] =3D 0; - for (j =3D 0; j < VNC_STAT_RECT; ++j) { + for (j =3D 0; j < rows; ++j) { bitmap_set(vs->dirty[y + j], x / VNC_DIRTY_PIXELS_PER_BIT, VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT); --=20 2.55.0 From nobody Sun Jul 26 11:01:50 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783342499; cv=none; d=zohomail.com; s=zohoarc; b=HDoh2FjotDFxt1834BTZsEizf5xflIl1yldVy2e52HG62CWUXT56HTDyOgNwuE+FHgpsdovakWvY8+lG6M4BbvoYfdb+T4P/QBO/prA3Gy6DBIv74HKQGgSn+iL0V1RTbIHGjzh1Xtb1/U4EhxIVH5ymIjHWxhw5Jwo23xVIzP4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783342499; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=fjemWcUQ0wpFl2+FNiO5wmSYq4+Q2OjQyjJjPZdkMWg=; b=Wa7d/ZyRFKF7GYLk9fIq3NLmbSPRJkyXqyfKj6+Ij/sLJgoM220qNg/XuocNGPv1u/nhhl9muMG5i3DLmCtu9Gdp2CVKuUrGSkUYUq85GuJemjZHs0YfJu/JtzkXtqM86eXsRP6atl/tYMIM8qI71m8F2teDLXkJK+jz4nrVc5E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783342499395705.3534221198747; Mon, 6 Jul 2026 05:54:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgiqK-0005x3-BU; Mon, 06 Jul 2026 08:54:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgiqE-0005uZ-En for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:30 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgiqC-00086r-Uh for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:30 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-106-zkzl4vEzP9uchR0_0-0UWg-1; Mon, 06 Jul 2026 08:54:23 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 4BA0D18052C5; Mon, 6 Jul 2026 12:54:21 +0000 (UTC) Received: from localhost (unknown [10.44.22.3]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1B41E18005A4; Mon, 6 Jul 2026 12:54:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783342467; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fjemWcUQ0wpFl2+FNiO5wmSYq4+Q2OjQyjJjPZdkMWg=; b=MZcHtrr27ZBArG2m9VsPwPEBvMyN87l7r31O3yobmXlLyC7ipkSKyLDomzR42YcezEJ7Dg oFJ9VIEIIWJUDuNGvU7Bbi7cvThk8uuMBRwkRgjLy1n7SuX6CWh9+yCzhPn7YVKhbUrIYC WQAXFA0uUT7YU2I0njgkKV/TYsB7kuE= X-MC-Unique: zkzl4vEzP9uchR0_0-0UWg-1 X-Mimecast-MFC-AGG-ID: zkzl4vEzP9uchR0_0-0UWg_1783342461 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Mon, 06 Jul 2026 16:53:50 +0400 Subject: [PATCH 3/5] ui/vnc: validate color shifts in SetPixelFormat MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260706-fix-v1-3-4b83a70e9f3b@redhat.com> References: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> In-Reply-To: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Marcelo Tosatti , kvm@vger.kernel.org, =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=2093; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=/764FwEy+oMuo7XRT7vkFLChejFIabvQLxH4PU5NCcw=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqS6Vn1pJsbMg3g1eXZo+l/L8WFjY5KQc0mY9DU x7SYRDucf+JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCakulZwAKCRDa6OEJdZac 5XU7D/wP1pv3zX9sft85OhZ3zGBmE7dWsseE5uyBlreG9+RXoPzYcBGRYOk6ZUEKG13KhuYfgM2 4rXQ72FNi6AhinHVKgKV4DzaZyq6gOQ2Ey4VOm01NXlkZH+xfcYR0cvsySv2lvyeATPQ/1h3DDa nR70QceDIGokm5dcYNNmWhylR8ndbwTyQoqQLpSKQ0dvWVfn43XkV9FsKsZPCYXjfmYmWO1vNW7 uv4BnG2ngavZA5+jIoKcF8rydInTIC+YkIETyij/xPpnJ72+vl23PK2q+2ozyM5Uy+clktyw+xV v6weXFQ7pA2v6s+C11Jg/kmeJzDTKm3AfNkgr3x3AyNNJj/zLgsEWfOlcsg43TqjXdbhr1Js1/2 YvZtF3qauo1yn2birZbJrcT8FvsI1CyMTseq54OeEuVf+iiop0Hda9MkTSwkgmh+UhLEIBhkKrU jMrvv1TSM4qTlMl08Mdu0cC3efALLTdxz3OUEwi2BPc9eS0scxPU9dqxWxV3Ccrw3R/CVQuJe/z h+pEqYyO/VZeGLr5oPPvCF7PeQbHkakceh/Oc/XJVSnsXAXbEr8EHlCEZEUu6jNyrDClIctEIZ+ GFiQbu35XyKlkBOnAV1wdSwqj9lttwKDCASwexJ16BHHWXwUPKabMFikTQw8vUZsH5uW0lLcdnX UU9CHkOmYWCpmyA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783342499778158500 A malicious VNC client can send a SetPixelFormat message with shift values >=3D 32, causing UB mask computation (e.g. red_max << red_shift where red_shift is 255). Apparently, this is not covered by -fwrapv. Reject color shifts >=3D bits_per_pixel before computing masks, and cast the max values to uint32_t to avoid signed integer overflow when a valid shift (e.g. 24) would set bit 31 of a signed int. Fixes: 9f64916da20 ("pixman/vnc: use pixman images in vnc.") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3948 Reported-by: huntr bubble Signed-off-by: Marc-Andre Lureau Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- ui/vnc.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 559d3954b87..94a38242c56 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2276,18 +2276,25 @@ static void set_pixel_format(VncState *vs, int bits= _per_pixel, return; } =20 + if (red_shift >=3D bits_per_pixel || + green_shift >=3D bits_per_pixel || + blue_shift >=3D bits_per_pixel) { + vnc_client_error(vs); + return; + } + vs->client_pf.rmax =3D red_max ? red_max : 0xFF; vs->client_pf.rbits =3D ctpopl(red_max); vs->client_pf.rshift =3D red_shift; - vs->client_pf.rmask =3D red_max << red_shift; + vs->client_pf.rmask =3D (uint32_t)red_max << red_shift; vs->client_pf.gmax =3D green_max ? green_max : 0xFF; vs->client_pf.gbits =3D ctpopl(green_max); vs->client_pf.gshift =3D green_shift; - vs->client_pf.gmask =3D green_max << green_shift; + vs->client_pf.gmask =3D (uint32_t)green_max << green_shift; vs->client_pf.bmax =3D blue_max ? blue_max : 0xFF; vs->client_pf.bbits =3D ctpopl(blue_max); vs->client_pf.bshift =3D blue_shift; - vs->client_pf.bmask =3D blue_max << blue_shift; + vs->client_pf.bmask =3D (uint32_t)blue_max << blue_shift; vs->client_pf.bits_per_pixel =3D bits_per_pixel; vs->client_pf.bytes_per_pixel =3D bits_per_pixel / 8; vs->client_pf.depth =3D bits_per_pixel =3D=3D 32 ? 24 : bits_per_pixel; --=20 2.55.0 From nobody Sun Jul 26 11:01:50 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783342494; cv=none; d=zohomail.com; s=zohoarc; b=dhvDuPXubaDO22CuU6UVRtfnWZyaiWZ8P0OTWIywjSGS+cn2RQ12GoFo3R7DrF670WiBc1UjdRavVT3spzp+Z54l3Xr/vgEt3bPFFDwxUnQcuH1kZYMLUFOFblt2xxrIfLbdt30wEWsBQGL53zkznkti5evx5lwJHTHTSqi8g9E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783342494; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JjErVZm9Wr2QI+kVTSz8W7d34vni0oT36iz299wkMnA=; b=FLNJlIWaY77lH1UibDJTXksT17XMHZT7tPbaiZt0QBNMrY5H3ZEEdZzVEvdGpsWw23n2Tgt7gAFSon09T1YWUywuVNDU4yGN0QX0yIwTyJcTYI16wwBxL8yVjM2HP8rDhDyECkw+2svFA+hUhVls738+S25dLrCLFminGNAwU4Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783342494612377.12667696402025; Mon, 6 Jul 2026 05:54:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgiqS-00060E-S4; Mon, 06 Jul 2026 08:54:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgiqG-0005wj-O0 for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:34 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgiqF-000879-4Q for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:32 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-272-0UuMTXsuMQK_B2gMTSjV4g-1; Mon, 06 Jul 2026 08:54:27 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5C50A18009C3; Mon, 6 Jul 2026 12:54:26 +0000 (UTC) Received: from localhost (unknown [10.44.22.3]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 4C5203000715; Mon, 6 Jul 2026 12:54:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783342470; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JjErVZm9Wr2QI+kVTSz8W7d34vni0oT36iz299wkMnA=; b=XzTcpK9Z7lIXLRlbTj4qcWUrsI90MyXyJ8H0s5v1cftKn+DczhnDei+qkirx5QG9/qJS4S NdMHNw0OkqnE5IUCvvjpQNheil9pQ91aWA9EUEuqpCq67xoiFB4AnNTY6LHrjeT39+gnIc sLn5+qswJDsI5DzIHvPFFfG7P0bK0mg= X-MC-Unique: 0UuMTXsuMQK_B2gMTSjV4g-1 X-Mimecast-MFC-AGG-ID: 0UuMTXsuMQK_B2gMTSjV4g_1783342466 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Mon, 06 Jul 2026 16:53:51 +0400 Subject: [PATCH 4/5] ui/vnc: use RFB wire types for client message handlers MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260706-fix-v1-4-4b83a70e9f3b@redhat.com> References: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> In-Reply-To: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Marcelo Tosatti , kvm@vger.kernel.org, =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=4266; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=ev9TNnw8x9m9l5HmAYMhEjTZybjblq9VWu37R67PYjM=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqS6VnNG2P1La5hNCD/TfhGcAh2IepUbEYvhYZX W+yjpr22eyJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCakulZwAKCRDa6OEJdZac 5YPNEAC0DhcSsO7EYZTArxnP8kXhDTGXHR5k+gBDzLeJFpskrTu2jfvqov+vAXCRAkU17RyJKVb XYkpGosSnio4Ss9hJu25QlBi1WMkalbTLl39sI6WpoBDEGBPkLfk2wRcs9KrIYZz3awV0f8/SSG nLug9vPpABRCLvZ4aFlvQQrUhNjwb5zQf5saD27a+wUVGntGWTRcZLP7yFdN1qTnWWXhwWq9jiJ kK0vhmUcpk+K3q0I8gNTeyzOsxFfb7lDR3XFwagTA+1Qu7UW0k9km8cL6D0X6IwxnAh3jlMG95y mmBDI4Zdu+ggp7SScIOKLo/+Q0+1D1JtIP1rgstZniqvxWZG8MHrp/u5eSMMCuD4Vdo3EUoyn7U fXzM78WIv1wPH7+Qd9IfCpjF/RlOj6fukng2fvw2zpMuDw8ot9UmRasaOST3ud4+srEoOGdRdG6 KFF6Hk+04/at7gIy2hLP6YKTt7x8aTnpRKhnDvooPJDZZRL67W9mDN27nyBSYgAfFhspQkaRinz hRp7Mh4gemRtNN3Cq/UJJGkJLCe/XmS78fFO9Adyk1Hh+4TbaZ9/5IYF8fj8Wcd4WUyKMzhQG2w 032mF8gFEjdDPfS/2uZtIkGBpSR3pxAzoWu420x6hvroCCAkYett3kivI5DzU7fw0MZgbNJq2Wi XuQ/Am748sAzM2Q== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783342495990158500 Use exact-width unsigned types for the static functions that process RFB client messages, matching the types returned by read_u8(), read_u16(), and read_u32(): - set_pixel_format: uint8_t/uint16_t for pixel format fields - pointer_event: uint8_t button_mask, uint16_t x/y - key_event/ext_key_event: bool down, uint32_t sym/keycode - do_key_event: uint32_t sym - framebuffer_update_request: uint8_t incremental, uint16_t x/y/w/h Drop needless declarations. Signed-off-by: Marc-Andre Lureau Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- ui/vnc.c | 33 ++++++++++++++------------------- 1 file changed, 14 insertions(+), 19 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 94a38242c56..14ce2816907 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -608,15 +608,7 @@ bool vnc_display_reload_certs(const char *id, Error **= errp) 3) resolutions > 1024 */ =20 -static int vnc_update_client(VncState *vs, int has_dirty); -static void vnc_disconnect_start(VncState *vs); - static void vnc_colordepth(VncState *vs); -static void framebuffer_update_request(VncState *vs, int incremental, - int x_position, int y_position, - int w, int h); -static void vnc_refresh(DisplayChangeListener *dcl); -static int vnc_refresh_server_surface(VncDisplay *vd); =20 static int vnc_width(VncDisplay *vd) { @@ -1763,7 +1755,8 @@ static void check_pointer_type_change(Notifier *notif= ier, void *data) vs->absolute =3D absolute; } =20 -static void pointer_event(VncState *vs, int button_mask, int x, int y) +static void pointer_event(VncState *vs, uint8_t button_mask, + uint16_t x, uint16_t y) { static uint32_t bmap[INPUT_BUTTON__MAX] =3D { [INPUT_BUTTON_LEFT] =3D 0x01, @@ -1841,7 +1834,7 @@ static void kbd_leds(Notifier *notifier, void *data) } } =20 -static void do_key_event(VncState *vs, int down, int keycode, int sym) +static void do_key_event(VncState *vs, int down, int keycode, uint32_t sym) { unsigned int lnx =3D qemu_input_key_number_to_linux(keycode); =20 @@ -2019,7 +2012,7 @@ static const char *code2name(int keycode) return QKeyCode_str(qemu_input_key_number_to_qcode(keycode)); } =20 -static void key_event(VncState *vs, int down, uint32_t sym) +static void key_event(VncState *vs, bool down, uint32_t sym) { int keycode; int lsym =3D sym; @@ -2034,8 +2027,8 @@ static void key_event(VncState *vs, int down, uint32_= t sym) do_key_event(vs, down, keycode, sym); } =20 -static void ext_key_event(VncState *vs, int down, - uint32_t sym, uint16_t keycode) +static void ext_key_event(VncState *vs, bool down, + uint32_t sym, uint32_t keycode) { /* if the user specifies a keyboard layout, always use it */ if (keyboard_layout) { @@ -2046,8 +2039,9 @@ static void ext_key_event(VncState *vs, int down, } } =20 -static void framebuffer_update_request(VncState *vs, int incremental, - int x, int y, int w, int h) +static void framebuffer_update_request(VncState *vs, uint8_t incremental, + uint16_t x, uint16_t y, + uint16_t w, uint16_t h) { if (incremental) { if (vs->update !=3D VNC_STATE_UPDATE_FORCE) { @@ -2250,10 +2244,11 @@ static void send_color_map(VncState *vs) vnc_unlock_output(vs); } =20 -static void set_pixel_format(VncState *vs, int bits_per_pixel, - int big_endian_flag, int true_color_flag, - int red_max, int green_max, int blue_max, - int red_shift, int green_shift, int blue_shif= t) +static void set_pixel_format(VncState *vs, uint8_t bits_per_pixel, + uint8_t big_endian_flag, uint8_t true_color_f= lag, + uint16_t red_max, uint16_t green_max, + uint16_t blue_max, uint8_t red_shift, + uint8_t green_shift, uint8_t blue_shift) { if (!true_color_flag) { /* Expose a reasonable default 256 color map */ --=20 2.55.0 From nobody Sun Jul 26 11:01:50 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783342509; cv=none; d=zohomail.com; s=zohoarc; b=W7uvbm+W65m2B1YFthtR5h7cW8JG60CSL6ePR19m7oSnmRMpQrwU+OrrsgXb2qmrrw7qU/1aY7MRRbMZSq+33JYd9JQZhlJGpK1OrDFCDkx2R7YdqzMUICMhQiDsFtYoKbrxH6io/iT8RhcTW01U4HQxtrhGoAyDhzIrVudB0E4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783342509; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=d+6znSRZg+Ltzq923NDQMZPCBTPsFuburG+TydhPNpk=; b=XmVHNlh+fDgIekD5rDXK0A4tUj9mCElJ9Kn7bkorikkOa1SWJqBAh3LPKcURHneXR6Ob9JZFcxlumS2WhjcbvTmMFcM0k5b9GF6YXkeaW8D7ukRwaqrk4lE50CJ89ajW1owz6ot1K5it+Aut5TnogRz2Qk5ewkLz9iF5FVnRha4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783342509270760.3251623772022; Mon, 6 Jul 2026 05:55:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgiqZ-00069T-V2; Mon, 06 Jul 2026 08:54:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgiqJ-0005xV-UK for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:36 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgiqI-00087V-05 for qemu-devel@nongnu.org; Mon, 06 Jul 2026 08:54:35 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-620-VIYyhgoENPyy-hDNTOofWA-1; Mon, 06 Jul 2026 08:54:32 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 54FF818007EA; Mon, 6 Jul 2026 12:54:31 +0000 (UTC) Received: from localhost (unknown [10.44.22.3]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6A7403000715; Mon, 6 Jul 2026 12:54:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783342473; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=d+6znSRZg+Ltzq923NDQMZPCBTPsFuburG+TydhPNpk=; b=XlIgll0i5LiH22Q6wRT7VXPynqdVLh8ILd0eFTRbzTyZBiUzAKOjtiHNBzRsKGLezueaI3 2D5b0utfLDOUoUvRmE68/i8RQ0qbU4kb5hH63PlGEcksyZ8wJAZxYnE97C29rmPcVvbs/x yh1q4E+woD3VjeOqYz00Fz9Y95G73ss= X-MC-Unique: VIYyhgoENPyy-hDNTOofWA-1 X-Mimecast-MFC-AGG-ID: VIYyhgoENPyy-hDNTOofWA_1783342471 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Mon, 06 Jul 2026 16:53:52 +0400 Subject: [PATCH 5/5] ui/input-barrier: fix off-by-one in keycode bounds check MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260706-fix-v1-5-4b83a70e9f3b@redhat.com> References: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> In-Reply-To: <20260706-fix-v1-0-4b83a70e9f3b@redhat.com> To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Marcelo Tosatti , kvm@vger.kernel.org, =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=908; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=EjMMSMFPquxQrS+GcZzjNBPDu5vs8Wn1NWzHRFE/Sbw=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqS6Vn6YI/duKo1sMaBQtRkjBpfCvDpcEW7n4D1 Pl4ngwcOS+JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCakulZwAKCRDa6OEJdZac 5S5IEACfDbZl29bgFSqQqEIOQaBDr5n6Be3OBrP9rY5d4MiuDGKUJ0nAlqgvGGEAcngEdbZVstd UyOhDzZMrgnsLEw+SFybYm9UoLsczIs047XLRkNd5xr5hNdCNsgEqpgNcuFq74GHh+AxfrJB0l8 oOx7YtP6mAsm5lLK2ShWn/FwO2WGCbv8uV4kV1nXb39dVQoR85uWhkj8Jmvg+2Kje0Gh9VAVt5t KcKNhbJuRiGQwXdlbQoVVRX7wVW3cggvBoEkfStBtpbCX65flr2Jh2AzYFFFyTe9DxzDrAZZZq0 vnq2D4z6dyLU3xN56/OTFJ1ABsIT11ZkFr50uggmIzGwMHtHLGbuGW5ljGda8IbcWBFll5GoQMM f8qKwoB99tV+Bhz0vSjPZldvKcBenGECy5Tr/AIvpVQsFNi20a5U/pjbxg+yf2f8blf5SiBgBgh 1T0D6flXu3GwdLreYAAPcRzEenBiGNY7ZcjWswXLj69+GJ1tK2Ut6D2qYwrPK8u26YMTDqls3/V v+bLTIGSB5LylLXM+b+MC/ndUVXrKZAFAdqmXiapd/IEVsiLmYcIqW/KD1n10KikdX9s6h3JSwT ojnlAUQD7wjMWbPb4IzqyTVXZr11i4iR4YWCt7xbiR+0oXENn/1iQ/qCurJejPOSBytctyWlGza zeJe0RIcCkG8aqg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783342509822158500 Use strict "<" to fix the off-by-one. Fixes: 6105683da35b ("ui: add an embedded Barrier client") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3951 Reported-by: huntr bubble Signed-off-by: Marc-Andre Lureau Reviewed-by: Laurent Vivier Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- ui/input-barrier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ui/input-barrier.c b/ui/input-barrier.c index d07027114af..0a238d4010b 100644 --- a/ui/input-barrier.c +++ b/ui/input-barrier.c @@ -87,7 +87,7 @@ static kbd_layout_t *kbd_layout; static unsigned int input_barrier_to_linux(uint16_t keyid, uint16_t keycod= e) { /* keycode is optional, if it is not provided use keyid */ - if (keycode && keycode <=3D qemu_input_map_xorgkbd_to_linux_len) { + if (keycode && keycode < qemu_input_map_xorgkbd_to_linux_len) { return qemu_input_map_xorgkbd_to_linux[keycode]; } =20 --=20 2.55.0