From nobody Fri Aug 21 21:30:43 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=gmail.com); dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=2; a=rsa-sha256; t=1787339737; cv=pass; d=zohomail.com; s=zohoarc; b=QNpRhQU74Pe4rQrZxYx8Y+JQXK0nwfbmOUhsN0Zo9zITlPDLyWwQBD0BstA4Uovkg49VxglqQCPUKSW2wyYaCjU8WABjpe8LS9ZY68YZ39+rnd1l04MrAXOXb3PQJ0bWHHQ+SLf/g305qzrYPsSZv+JLx5zmZ/ulm3rRayULLJw= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787339737; h=Content-Type:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+oA+jUn5llXQsoQ81nJjEf6x+kdBND1+WuOS+/5ZfYk=; b=H4qoOzz+DncihKCsumIvMEkTVyBBfBxpKLl/TTJYRAF8JiBW4MuenHC+9Nc48LKr4iqD2YhRr9j+QwQCC12BZbofyTx6GirP9BY7YD6olU1IAkjCwChXHkpCiJ8CrHMI2mNom5qwnQTMaysVMgbE5alsv9ZLr3gGYU93vUOKggI= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=gmail.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787339737265320.00126176321123; Fri, 21 Aug 2026 12:15:37 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wxUhh-0008Jt-7J; Fri, 21 Aug 2026 15:15:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wxUhf-0008Cl-Na for qemu-devel@nongnu.org; Fri, 21 Aug 2026 15:14:59 -0400 Received: from mail-lf1-x130.google.com ([2a00:1450:4864:20::130]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wxUhe-00079E-3h for qemu-devel@nongnu.org; Fri, 21 Aug 2026 15:14:59 -0400 Received: by mail-lf1-x130.google.com with SMTP id 2adb3069b0e04-5b4740ec30cso1378330e87.3 for ; Fri, 21 Aug 2026 12:14:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1787339696; cv=none; d=google.com; s=arc-20260327; b=iRcFvA+XZn/Ebp7LD4EzL7xcVuYo3RvhIsvd8o1FfNd1BWPb72wDc7+jhtPcC821bo o5qvH3Z3AyPY0RCdVl3i+sbgpY8p+eNLqVPDz19pzde0QQA9bwuo/aIe69I+1PdsIMZz BnXX8Nk4B+BLOxajSIoWaSH3AT8BJZG24B9CR6VBALqSIE3qLSgP3DMSs3405rdao0zi lxHhjgMqAyEGfEUrKRbdJYxv9U2lmZJG88lQ8F96SCpfHiY87nnIEQpIZ8ZokA8TKgtq DPzYj/Y+JCOFYpvxa6O7zKPLdKBkqsXpUmaFgpx1AAELKCAJriCxWzQiXl2s3hLC2NPK u2IA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:mime-version:dkim-signature; bh=+oA+jUn5llXQsoQ81nJjEf6x+kdBND1+WuOS+/5ZfYk=; fh=WS/FPZF4INf3fCqbT+W34SJMw0WsZ1wrdPlyicLyxsI=; b=EGQ0efhF+z/OmForF+DWUjK9+WBZJG+FXG5amX7UKAAhtoqOyOrFiFWSNzLbDEgAZD O8apUuOGUqUZBnJFEkdhxROXvOgRYp/ju7NEAyMp0jgrXhOvOT0cpmwKixxa1eAkkl7r 4OkvLCJNsIGW5pXGSul/dRVx374KnjugOhB83lyScb8yxIEiKlbdmHYjqvN1oN9jlGQg RTF6NheScg/Xv7YVEpQudE2VjNaaOZ3WZxLnCCR+YEK8tAAd5m+63RedhExXMlqyS/z+ 2lbwfQnFARSn4+z/6pLKdyIaHzAjwCDHhCMpOVtUtX9pTezb0Mq0i4uhncNOq6AGCxKI krqg==; darn=nongnu.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787339696; x=1787944496; darn=nongnu.org; h=content-type:cc:to:subject:message-id:date:from:mime-version:from :to:cc:subject:date:message-id:reply-to:content-type; bh=+oA+jUn5llXQsoQ81nJjEf6x+kdBND1+WuOS+/5ZfYk=; b=aty1/OEJf4t/VsTSyU0jymX0CaK+DN//wYhF0EyXqLfOrOAYGNKO4u0+tWwrFl0mzO imryERL6eRXk8XE500OyoEqDemZLqwiAaxuzfI+eK8d/sAWNyO+C3z4OEWUOItPbD9e3 qKhK/e63qqfXKjv8QVeduUQeTt7xYRlJeh6yHHNTVA6MX4UihQUA1mQLMu7C2yD/p34X w76JKNSkyUPxQuVwRp0Y/dTaKtm/wfZVMDsSUe5AoszIOD4jbjR/AZcTsdsE0WhgMJ9Z oUv47f1WNjXaf3TO2uT8VBeoPpQmRAOJ7Ksq6m4jG5cZa7Mifbz01DfJwobmOKEdx/ei Hr1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787339696; x=1787944496; h=content-type:cc:to:subject:message-id:date:from:mime-version :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=+oA+jUn5llXQsoQ81nJjEf6x+kdBND1+WuOS+/5ZfYk=; b=siJgYwxYFjwGe5JD7cCmq/n3TleUBg/NSn2T3KASSOWdATVm5Xp+oI6Uuq2nM9s2Rb ac9UcERQ+xdUrj8MdsCWe3hnuakCXRRx9NzHGVvCK9V7pQxuj7EgrjuEBT2XfTXqLxqa C11KG6I04fSVN0nRQrzn2xz114Yot5hfN62QVzvQEDXzxb5hZvj5Ge744xHYRac4c6F9 8Oet2E8WITKgJ0tibeXmI0Nl1JkXCNO4YIS6ErgE+kyrUehiv5g72HhdMgBm39uhOvVC Pn9UF0WRrwlHlSakffb2GrADUYUlXrXjMQyo1EWxEVGBbj11jUb9J9Om1oJL38AjeOPq fIPQ== X-Gm-Message-State: AFuF++kwPSGfyfP/UXUDFTD2QXFm+tXTJg8fpjezO5aG48hE+0JhBh0b xvalymi7s7ohYdFBzHYt32po4rA3qJ2nu+iJco4ODUQVcJV2aNWyHRHeQiKTvIN2MFK4ZTv3J1P lHRr5h9DLfc+wJ2nHWN68n059v5ovk7KYuFOpRyk= X-Gm-Gg: AR+sD13cT6zm4B0YBRHTZk/gt/4N7NKGYibhfaAwXIYfDaw/Yt/4eL7hg0d4G9GTVMc K9zRNwelOk3fCGWM7bqO1Zh84VhKF5lOIw26MSgk4OiBQ58vxx3Xg4UMvsdUnyHw8EjxnTMYhcw lohBW/ihvtw9wP+zK+5785nMRT7IxsHJ3oTt4NWjMr9Whqb9MWtlc0RpgB2GioEMeUEYyiLg5MJ j3wIEUyrd9XAkzUSVLQtDVowFmYL5tXBQ/lZ9JZmqdZ3LgxajM4w+6TR08XiTdnGTB4FVVfnQPp Eh0OYnnuUiLeO2IxLo7AgzwOwh/tLIFeMOZxO+ive2oftz9Pwu64xh/VUrqqZ2AQReaJMGgEh0i re+0= X-Received: by 2002:a05:6512:238b:b0:5ae:c27b:f7a0 with SMTP id 2adb3069b0e04-5b4841f503emr2746232e87.11.1787339695485; Fri, 21 Aug 2026 12:14:55 -0700 (PDT) MIME-Version: 1.0 From: sin99xx Date: Fri, 21 Aug 2026 15:14:44 -0400 X-Gm-Features: AcwNN1Vutc5rckdA5P64UagxOth3m0nX95u7Lew0TnIAOtzz0IwU9SgehfFr-qM Message-ID: Subject: PATCH] vga: split text renderer geometry cache from graphics renderer To: qemu-devel@nongnu.org Cc: marcandre.lureau@redhat.com Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::130; envelope-from=sinxx198@gmail.com; helo=mail-lf1-x130.google.com X-Spam_score_int: -17 X-Spam_score: -1.8 X-Spam_bar: - X-Spam_report: (-1.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1787339741110158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vga_draw_text() and vga_draw_graphic() share last_width/last_height but store them in different units (chars vs pixels). A graphics frame leaving values equal to a following text frame's char counts makes the text resize predicate compare equal, skipping the console resize; the glyph loop then paints out of bounds of the surface. Commit 95687639e6 (CVE-2026-17516) fixed the graphics-path consumer of this confusion but not the text path. Give vga_draw_text() its own cache fields. Fixes: CVE-2026-77913 Cc: qemu-stable@nongnu.org Signed-off-by: Warisjeet Singh (sin99xx) --- hw/display/vga.c | 10 +++++++--- hw/display/vga_int.h | 3 ++- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1241,7 +1241,7 @@ return; } - if (width !=3D s->last_width || height !=3D s->last_height || + if (width !=3D s->last_text_width || height !=3D s->last_text_height || cw !=3D s->last_cw || cheight !=3D s->last_ch || s->last_depth) { s->last_scr_width =3D width * cw; s->last_scr_height =3D height * cheight; @@ -1249,8 +1249,8 @@ surface =3D qemu_console_surface(s->con); qemu_console_text_resize(s->con, width, height); s->last_depth =3D 0; - s->last_width =3D width; - s->last_height =3D height; + s->last_text_width =3D width; + s->last_text_height =3D height; s->last_ch =3D cheight; s->last_cw =3D cw; full_update =3D 1; @@ -1845,6 +1845,8 @@ s->last_width =3D -1; s->last_height =3D -1; + s->last_text_width =3D -1; + s->last_text_height =3D -1; } void vga_common_reset(VGACommonState *s) @@ -1887,6 +1889,8 @@ s->last_ch =3D 0; s->last_width =3D 0; s->last_height =3D 0; + s->last_text_width =3D 0; + s->last_text_height =3D 0; s->last_scr_width =3D 0; s->last_scr_height =3D 0; s->cursor_start =3D 0; diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h --- a/hw/display/vga_int.h +++ b/hw/display/vga_int.h @@ -122,7 +122,8 @@ uint32_t plane_updated; uint32_t last_line_offset; uint8_t last_cw, last_ch; - uint32_t last_width, last_height; /* in chars or pixels */ + uint32_t last_width, last_height; /* in pixels (graphics renderer) */ + uint32_t last_text_width, last_text_height; /* in chars (text renderer= ) */ uint32_t last_scr_width, last_scr_height; /* in pixels */ uint32_t last_depth; /* in bits */ bool last_byteswap;