From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM8PR08MB5586.eurprd08.prod.outlook.com (2603:10a6:20b:1d6::7) by PAXPR08MB6942.eurprd08.prod.outlook.com with HTTPS; Thu, 3 Sep 2026 20:26:09 +0000 Received: from OS6P279CA0165.NORP279.PROD.OUTLOOK.COM (2603:10a6:e10:39::18) by AM8PR08MB5586.eurprd08.prod.outlook.com (2603:10a6:20b:1d6::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:26:07 +0000 Received: from CPH1EPF0000051F.eurprd04.prod.outlook.com (2603:10a6:e10:39:cafe::7f) by OS6P279CA0165.outlook.office365.com (2603:10a6:e10:39::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:26:07 +0000 Authentication-Results: spf=softfail (sender IP is 99.81.216.78) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning openvz.org discourages use of 99.81.216.78 as permitted sender) Received: from nat.eu.perception-point.io (99.81.216.78) by CPH1EPF0000051F.mail.protection.outlook.com (10.167.241.234) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:26:05 +0000 X-PERCEPTION-POINT-VERDICT: CLN X-PERCEPTION-POINT-SPF: X-PERCEPTION-POINT-SPAM: PASS X-PERCEPTION-POINT-SENDER-IP: 2a00:1450:4864:20::434 X-PP-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::434;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x434.google.com;PTR:mail-wr1-x434.google.com;CAT:NONE;SFS:(13230040)(12012899012)(2092899012)(3072899012)(82310400026)(6059299003)(43022699015)(10067099003)(19002099009)(18002099003)(16102099003)(22082099003)(55112099003)(5063699009)(57112099003);DIR:INB; Received: from DB3PR08CU002.outbound.protection.outlook.com (mail-db3pr08cu00206.outbound.protection.outlook.com [40.93.64.86]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id nsalmml1q3q8bdv62k59irtdss39kva5f0lrn181; Thu, 03 Sep 2026 20:26:02 +0000 (UTC) X-SES-Spam-Verdict: PASS X-SES-Virus-Verdict: PASS Received-SPF: softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.86 as permitted sender) client-ip=40.93.64.86; envelope-from=den@openvz.org; helo=DB3PR08CU002.outbound.protection.outlook.com; Authentication-Results-Original: amazonses.com; spf=softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.86 as permitted sender) client-ip=40.93.64.86; envelope-from=den@openvz.org; helo=DB3PR08CU002.outbound.protection.outlook.com; dkim=pass header.i=@openvz.org; dmarc=pass header.from=openvz.org; X-SES-RECEIPT: AEFBQUFBQUFBQUFGQUNBTnQ1ZzQyOWcwOWZwL2l3cFNDV1dZL1gwRnU5aDEwczFQeTRmYTIxcm53ck1DYUFKNlZFckpxM1RZVjRVckdMQUtRV0pjK3BQQmpUMThLbW9wTXBrajBhYWV4UXBwbG9jMEFLZnVhK2lwd3JMQVUxQ3ppZ2VUUW90amVVb0ZPMW1zNXJOK0lteVpRZHppVStBcE9SVjI5bFp5aDkyUi9jNnREenRCR1VkejZlOTZEeHd1SU1uZ2dSbzZVR3JjbkE1QUxkRnZUQ3FYbW1RWStKTFZ4NlMzdGowUHJHckFCOWFrMjh0UFNsMzhqd1pZWDM0bUo3Mmt1QlJLY0lQMEw4Q0pmRzFUWDlxZnZHTUdoYlF4d1NVOStZck54dEt6blE3OVpYNnRMVEE9PQ== X-SES-DKIM-SIGNATURE: a=rsa-sha256; q=dns/txt; b=nRCIT9lxuqnp41lWNzXp3Lxq011z4NetoeB7K6ZIwjowGXGP26pv/EAtn0LsgW1hJ3SuGXpIHB1S50/7hQLSCAEkg+s2qBfIyg7NPNnnTCwS9lyNF69gFVdva2L4p0r11nfSiiEBL9S7UqcAHbwcnvsmq3+n2fvA250IPeJhZqU=; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1788467162; v=1; bh=krFkCigPvf/tAno7zaJQr2BrK/zxr+KYa+0awXBTC+Y=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT; Received: from MI3PEPF00004E95.ITAP293.PROD.OUTLOOK.COM (2603:10a6:298:1::445) by AS8PR08MB10080.eurprd08.prod.outlook.com (2603:10a6:20b:62b::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:25:59 +0000 Received: from MI3PEPF00008483.eurprd02.prod.outlook.com (2603:10a6:298:1::6a) by MI3PEPF00004E95.outlook.office365.com (2603:10a6:298:1::445) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:25:59 +0000 Authentication-Results-Original: spf=pass (sender IP is 2a00:1450:4864:20::434) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::434 as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::434; helo=mail-wr1-x434.google.com; pr=C Received: from mail-wr1-x434.google.com (2a00:1450:4864:20::434) by MI3PEPF00008483.mail.protection.outlook.com (2603:10a6:298:1::6a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:25:57 +0000 Received: by mail-wr1-x434.google.com with SMTP id ffacd0b85a97d-482ea739de2so199851f8f.0 for ; Thu, 03 Sep 2026 13:25:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1788467157; x=1789071957; darn=virtuozzo.com; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=zUN6a5D7Kybgjf97j8twtUAhLEV4eIVhNpZSMaHalbA=; b=foLqqIXBI2wW4FTcwK7Xwat/fDgjaH2ylhQe1SJVIvpYULOFbj7n6WY0ucadJSYp/A xnvBhXpKnbzJ91fkr7ufD0wMyXRiWtIqvTHX3vJIJhrtI24nD+G2kx7afv8GBZoTCC+R 0wxke2PxbIdqAU81feBbk6yzmcian8VRBcLcWiQ5EnRw3Qq5ZPpoOc4nTOFRPBw1aYy9 RTZo8d4Jzn7ZISo9PquwzwjXW7YUr6/2fRNdjfjFZEu2mPPsFUHuCAKqrblq7hJy1XjD hKAuGC/oAA0ejjGhUn6/z1w9ClT/rOUW7cxA5M6hlDMkXJguDuNdZI7p2FGyPIeoRgno hLVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467157; x=1789071957; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=zUN6a5D7Kybgjf97j8twtUAhLEV4eIVhNpZSMaHalbA=; b=iFmx+TCz9PN0Tmh7Hi1BGyVQtwffPrXZAZdA+mdkCwOQSVfW7+u4gHrjdmq8rZm988 cT/2GxbiYY4ih9GTPMmbhgx0xKh8Qp45mSbanoInpgvgmAgolADjY0bsxd1tF6MWyMv5 0vyho5LPNwOYwTEbX3gztoX/rmbF/M5A7RTRUG/yLHiZtTSzmqxUlvfNVGtT+gh0X0uN +QXObWxntzqvtULxXWOom4o79wWehgsG4xWZN9s7CIXWNTqURoSV3ZFQECEqlPasoRGY VzigRUJrxKxUvuQsG/jRK2gcwRiIeLKBh9ilDNX/8VKHal+D8cA1C5dze8cwI6SqjhPV T67g== X-Gm-Message-State: AFuF++nbgJDgOiyA+LpQa5DUIJ4SPfPRSImkmHDM/En5+IHqKX33cJpW +CU0YkHZyfcXDQrxAQHNkpPqJvdLdQvingjdn/QOisHRP7qHWwe60nSRHdTPvFfFxtleNigRsI1 OVEapFhI= X-Gm-Gg: AYBFou2rrvGvkrxLUofNoeujCZkdOVDZRt/iNJVGAMa7RfELTAC8bCfHBUa1FrA3NaU pSODzDR6UaTv6t7cj/U550+RdezCcLCCII5klqClMwWyMAiXFWTW2AGuZdwuekIBTBVDqFHhvX0 /Z27JRlfbqnHs0p4HjrHbxCggIuttDgjfxbp1mWFckyVaLVoATr1xPJMPl8jonm/tGNK6OxVGPX 78B4SoIR6GtWlvfoIo9TVhxLNDRuPg2eKkKRHFwRobhnCqblS+u4nYAkft1ZN4A2dGD64+PHrU3 t7jRHVybvxudWMr++t7ROI1VwEA5xCdA8FFi8jjXa9dB0jwkKTWgn7IL0F5po1PaKlWmpz81VEE 67/OWpMTHd26OqJTWwSa4JzdIsoeDvKcovNcUwYan/b3ezYOY8iajZup34oMdlAIclCuEJhO3us ZcnIbQd0n1Rn9Rh6R9LBgTR7agy34QSMpmR2hZDPucllCbUTfWCoioduXS X-Received: by 2002:a05:6000:26c1:b0:485:83a6:b2a2 with SMTP id ffacd0b85a97d-485872e9dd8mr2784367f8f.23.1788467156687; Thu, 03 Sep 2026 13:25:56 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:83cc:ab98:cda9:7dc]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm950600f8f.8.2026.09.03.13.25.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Sep 2026 13:25:56 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: den@openvz.org Subject: [QEMU HCI-8.0 PATCH 5/7] hw/display/qxl: validate monitors_config heads[] in phys2virt #VSTOR-144000 Date: Thu, 3 Sep 2026 22:25:47 +0200 Message-ID: <20260903202549.2754937-6-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260903202549.2754937-1-den@openvz.org> References: <20260903202549.2754937-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 1 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:1 X-MS-TrafficTypeDiagnostic: MI3PEPF00008483:EE_|AS8PR08MB10080:EE_|CPH1EPF0000051F:EE_|AM8PR08MB5586:EE_|PAXPR08MB6942:EE_ X-MS-Office365-Filtering-Correlation-Id: 123f44dc-ddd6-45d5-f462-08df09f99580 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA|SL X-PERCEPTION-POINT-CUSTOM: vzpp X-Microsoft-Antispam-Untrusted: BCL:0;ARA:13230040|12012899012|2092899012|3072899012|82310400026|6059299003|43022699015|10067099003|19002099009|18002099003|16102099003|22082099003|55112099003|5063699009|57112099003; X-Microsoft-Antispam-Message-Info-Original: =?utf-8?B?M251VzBPa01BYXJ4MVRWRUc0L3dwc3F0b1BhRUsvZWRDZmdMc2ZtMW81YXVt?= =?utf-8?B?ZDhEYnR5bTJEczc2djF6Wmw0L0tkTUtwaGNDbjlxMXFqeVlJYjBOMytQaVhU?= =?utf-8?B?SEF4QVQ1NDJ2Y0RMbjUwdjlnY2xBd1N0SEc4aWZLK0U0WHVkaWYvK2VmOXQz?= =?utf-8?B?a3VXSkJzVVVGRnhnZnQzT0ozTERPOGFLMHIrTGJVVlZCQnc4L1RucSt4SWVp?= =?utf-8?B?by9wdzRoYTZEVDE5TGJHNnFkRFVTenVqSHU0TklwN21ZR1BkZnpWeXJKNUpM?= =?utf-8?B?N3RGSlhaNEhIMXptRlJvTHBUSGF5anNSanIrcys2S2NjYldpZVR4c2NJeE5C?= =?utf-8?B?RmoyOG9hS2JDbEo4L1RoNjNlUGZWbVdUVG5tMmZ0MEtBZ2M0YVZGSlYxY1o2?= =?utf-8?B?SGhRc0QzdVVKdmQzb0M0SlZKcDlTeXhmMEUrMGFpb2JjY3ZxcmxkRU5pZEZ2?= =?utf-8?B?UTR6UENtRmZCQXBkVTNUdTA1cWU0SVM5d3puTTE0NC9qZnJyTysvUTh1cDB6?= =?utf-8?B?allqdlpLeTJFS3F1TXkvbTNHa3J1cm5UTXpNdDhYV3d2YmEyUG5hMFl5Y3NB?= =?utf-8?B?SlRPQjQ4R1ZIbzhDSGZ6VGFKSUg1WUttU2VGUkQrZHNKUHRTdDU1bEJQRFBP?= =?utf-8?B?SmxaT1FRam5NK3JlQUZlMWhUT1VZVitkNXpabHZEenFERmxIRXl1dkhUZHhU?= =?utf-8?B?SkQrN0hVemZSZmJnUTFsYWpyS1E0NWVIWm9KNXA2NUNzTEt6cm40bXNkSjQx?= =?utf-8?B?ejBjWHQ0S04xcmJDb2I1NVN0WitlcHNub3NrT1N6TWx6MVR5Z01aMnRRVlVh?= =?utf-8?B?S3hZUC9PZTh2VnJDcGM0YVZUTHZrV25HL1RoSkJUTVVkM05UaU8rMDJ1eVds?= =?utf-8?B?S1h6Z2lyMzZGVjFCemhLY3R6cUswRTBUTDZjR1ZMQkJtbXAyakxLZDBTbGg4?= =?utf-8?B?Z2Q0ZElYTXZEUzRqK1ZjNkY4QWFYN2s5bldHdmtudzBXa3RqRkJuMFFzblY5?= =?utf-8?B?a21jT1IrVFZMT0NwbXN3MldVaUg3NVgwR25xMFZlSHhtaXNIYVBpNzZhT2Vm?= =?utf-8?B?aUxSRWVrV0kyMUIwd25vTXhyWjV2SERpNlV4bldKN0dZNFVQUDlMRS9ta1Qz?= =?utf-8?B?b2lQYzBCT3pWdDR0alFpZUI0NEdSZ3pNVHlzOTdGRnhleGR0NEhsWU5sTEpF?= =?utf-8?B?R21PZUNWNG9xTU50MldtclFBRTZLeXF5TXdnSnRGWmt5WDNsSHA3LzA2anV4?= =?utf-8?B?TU0wWXBYd0VYaFpmUjhsWUEzYmtBMEltZS94T2hXKzJMOWlhOVh6b3NkNDdm?= =?utf-8?B?UmN1SnV6bk8zbmJpL1RPUDQyejVnOTI5QXZmdSs5RnpPMy8yT3VkdWZidU8v?= =?utf-8?B?ODRiWnhwZHRyeVBRNkpiUytXdDlYd0ZEVFVKYXl2MWgvRmVmdWd2UGJ2ZWFs?= =?utf-8?B?cTB0MXRxRk9uMVBQZ0RQVjcvUXAxZjlmOG1kbC9sSWpUNUhXWnlBTEdRWUxX?= =?utf-8?B?Y1RuN1hvRG9JdUllUm9ITmJmdXk3QTNhaFFKbzZvNklud2JpUjRPZHNRT1Z1?= =?utf-8?B?MTRtc1MzaSt0Tm1TWCs3S0FHV3U5dmdQMzhodjZjSzRuMkZRUEkwbUJ0dm0w?= =?utf-8?B?SWpEREJ4YXRhYk4rbEt2N1BTa3VYR0IvSzFqaW5zWGk5V2R5YllKdlh3NWlL?= =?utf-8?B?S2p1akFwVWlpdG8rSnMxLzVnK3RDNElkUWg3cXI5cmRtN2FsWVc1Q25oMUtN?= =?utf-8?B?emJySUxWUm0vK0t0L1drWmh1Y1FscEsrNWJzZEV1V2FzZDRFWkZMekFQMjVF?= =?utf-8?B?Zjg2eDFlWEl2UGJuVjBSTlcrNkJ1NmpkT1ZaRWR4VzJqOVBxZjRpVVlkQ1R1?= =?utf-8?B?VXhBZ0Q1bGRkaVdnK2QvaHZKaERrdXJ1TlBnRjZpekxVY0E0T3U3anJKSFZl?= =?utf-8?B?blVKVkMrRURzVnR2emRWbkpjNkg1MlFkWDV4d2xvZjdLaks4U3FlUTE0TnFh?= =?utf-8?B?ZWtWV3JDT1oyOXU3dUJxYVNLSFEzQWhqeFhuOWxrS1FOOGdpdHJwSnMxZENL?= =?utf-8?B?NDcxRWE3TEpOOU44NnAvdWZYN2hzR3JwTFp3bDVhcnVlaFdaZ0lCS004UnBs?= =?utf-8?B?am9YNTdpK05UeDM3V3owdmZmb3l2a0NMUlRraTBvYTg5c1U5Mm1IdVRNYzZN?= =?utf-8?B?cWNKWWFyZ3R6QmRWZU9jZENuTVhaLysxRmdpdTJJMUZUOHNiQVFjVTFhdG5a?= =?utf-8?B?dlpNSFVoaXJwb0xjelBpcHV5T2l1RlBkLy9jeWpxY1JzUkJXZEF3dURPdUlw?= =?utf-8?B?UGVYbkF4cGlNRkJYT3ArUVdYNHhBUUxFdVJhZzZGQ2pMOFprbTFKY0FVdXpr?= =?utf-8?B?L2cwSFJjNkdFci83VzdoSXUzUlNxQmthUDRVdzFHSlZaSTZZR0xKOTBLS2Vq?= =?utf-8?B?OVNZRjBCbUNrZXRNV0pyN1BjQUVKdHFjQjZpbnJsQzNuOEZkRnZuODlrWUJZ?= =?utf-8?B?QzdIYUpMYzBYZ1pVTVFwRUUyNDlramlhdGdPR21ZWjU0UEFlMG9hQVo1ZFVn?= =?utf-8?B?Z2pFa2EzLzROOFBmMy9xd016dVVud3BmN3A4amJUOWRsMzN0Ym9yNFJLTEp3?= =?utf-8?B?UFNVeE1YRHlWMU1lN2ZBY2FUdUNqYVgwL3ptZ2RQOXoxM0tYQXRqMUNhSzRX?= =?utf-8?B?OW83UXl4REdPMlFUcjdaYSszU3dsQUZGT0t5dWd5bk9UL3lIOXJZTW9lWWE1?= =?utf-8?B?VUJuclhZaVh5Y2tXdUtSTm1WTmJDSUw1eXEwYTA0WjIxM0xaVmszTzJ6S016?= =?utf-8?B?NUR2NnZTZTMra2UzeHJvdW9RNkl3ajJqNmFWTFZCR3RJc3N4MUZHak4vR0Zp?= =?utf-8?B?QW9xOTdWT3VTUzBaaG44ZFNta1BXdkJKWFptMWRDa3EvVHE0dWptb3NHbFpW?= =?utf-8?B?cXZUQUJPN3R4Mjc1TTRpRy9qVEs5N3ZVeWR3Z1RMS0lGYWVmTURsU1puRllj?= =?utf-8?Q?Z0ttswtkwPhthI=3D?= X-Forefront-Antispam-Report-Untrusted: CIP:2a00:1450:4864:20::434;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x434.google.com;PTR:mail-wr1-x434.google.com;CAT:NONE;SFS:(13230040)(12012899012)(2092899012)(3072899012)(82310400026)(6059299003)(43022699015)(10067099003)(19002099009)(18002099003)(16102099003)(22082099003)(55112099003)(5063699009)(57112099003);DIR:INB; X-Auto-Response-Suppress: DR, OOF, AutoReply X-Exchange-RoutingPolicyChecked: Gg7jcNgOp00ZQTnZbVz5/FCnYPsItCaZbrLrFYN3sosE64rAZT8K1AG1tTYjv35fZFLpJewmH+5RWUC0YzmgKbp5vBLdCaH3ukyigDXtKIPR3zym75QiMBscrcbEkLqUw58jQRHPhsZm3L0Z438nJovbq5VHPGLLORHPRZyPGnhADUtHJoDVNwQKwj09Znf1/2Ls2Y3YfP+k+lb6/AYRoyUAj65c4VYQS68Q6STPOe3rgCq1a4obLgXz00QYz/vvONHh31TieJoqzEubZeXTrN+AcBU3VJSKJoQB9fCSuKt4Pk2xP1Gc54XSQ85/W8L9SNV8qv2bQ/7lkbGpbSn+4Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB10080 X-MS-Exchange-Organization-ExpirationStartTime: 03 Sep 2026 20:26:06.9662 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: 123f44dc-ddd6-45d5-f462-08df09f99580 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Transport-CrossTenantHeadersStripped: CPH1EPF0000051F.eurprd04.prod.outlook.com X-MS-PublicTrafficType: Email X-MS-Exchange-Organization-AuthSource: CPH1EPF0000051F.eurprd04.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id-Prvs: 0ce48b85-41b8-4b58-6ea9-08df09f98fd3 X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|6059299003|12012899012|3072899012|35042699022|43022699015|2092899012|5133699003|55112099003|57112099003|22082099003|16102099003|18003699003|5063699009|10067099003|19002099009; X-Forefront-Antispam-Report: CIP:99.81.216.78;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:nat.eu.perception-point.io;PTR:nat2.eu.perception-point.io;CAT:NONE;SFS:(13230040)(82310400026)(6059299003)(12012899012)(3072899012)(35042699022)(43022699015)(2092899012)(5133699003)(55112099003)(57112099003)(22082099003)(16102099003)(18003699003)(5063699009)(10067099003)(19002099009);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Sep 2026 20:26:05.8768 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 123f44dc-ddd6-45d5-f462-08df09f99580 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: CPH1EPF0000051F.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM8PR08MB5586 X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.5705997 X-MS-Exchange-Processed-By-BccFoldering: 15.21.0382.004 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003); X-Microsoft-Antispam-Message-Info: =?utf-8?B?emtrdlpaT2pCNWExbzZib1RJazUvY1lMSWc4azd1cmNRa2VyZHZaTDBSSFE2?= =?utf-8?B?NGlHMTk4dlRMQTQ5cVJ6L2Z5bVlXb1JnVG5Dd2k1MkJ0Y0w5SE4rNzh0SGpK?= =?utf-8?B?Z2FOZTVVenppcDYyMzFKYjNxVHNYaWtaUHB3WFRURjl4UHY3bWVPQ2Vja25R?= =?utf-8?B?bkQ3UGNwblRTOTdxeDQwNHYwbm9ydUY0NnVqQVc0dzR1S2tRbldRR1hMUnJ1?= =?utf-8?B?L2RvcVJpZmR6R2ZIZmxHVmt3SUNDR296cE1hcmFaZzdvQ2ErL0QzemVUYzE0?= =?utf-8?B?c29HazRtSCtwalBaQ0NHazlYV0trUHZ5d0dZUlh5UDYrZXh1Z1hRd1M5MVZn?= =?utf-8?B?OFRDbHNPdlUrSTZGOXNhVnozczkzKzBpa3ZVTldUQTBNOEhSQll4WXZuWkZB?= =?utf-8?B?eEU2QTVIMFd1TEUzOUhSekJjK0pmKys5Ukc1WW9iLzQvVjNsemM2TGJGb3hs?= =?utf-8?B?SGt6TEVsZE1PY2h4MEVieHRrSks2OXZ0aDY3Q0VoWmdkWkwrTXdqVTI4ZTNQ?= =?utf-8?B?YXRtVVBnS0dkaHRnb0YxSExBSllab0tzbTF0ajlRS1BjYVpWeGx0b0E2bk1r?= =?utf-8?B?RFhTRU50Zk9PcDc1VEVYT0xUTUpHZW9kUzc2ZGkrWS9MQnVBbEFvRDNrK3VQ?= =?utf-8?B?bzVxUW5wSktPcVF0YnhsZnNOYlQ5RXRBeWl3QngyeC9aNE9wbTNLZ0d5bGho?= =?utf-8?B?Nm1vUkZhREtQSGhJRjhwaXcwTDVrN1phOWxxckhRRG02d21naFhYR01BdkVr?= =?utf-8?B?ZW12d2Y1UWNPNmszbWlMQTBYZWVMdkxDV0EvMTRpc3dweTUrcThONjFkbCtm?= =?utf-8?B?QVlrdytzakZjR0h1Uk5wTnhpVFpGYTBtNzJUWVhHSGtOK1VvQ0I3cjVmMkV1?= =?utf-8?B?blpsRU42UGpBTk1DVWV1dzBVM2Z0dC9BZGVycm0xbWo1TEszcGV3d3FnbE54?= =?utf-8?B?Q0dCRDE2UWx3QXJOM0RjQVRzaGpLVnlScWFmTlhva3AveTlkcURscUxvOHFr?= =?utf-8?B?eGhSSC82ZU5BRkU3MDREWWFQOHJRTFhEd1FEVU9xb0h1OFdjNElsRGh3cDVh?= =?utf-8?B?S0p4ZGF3WTc0Ym5pOGR1Y2tpRTVLcFFSTE04bjZyS2FjRnFpajA2MlNUTlNn?= =?utf-8?B?NmQ4NGVwSThDMHJ4dGo3ZWVJNldpMGV2WHhVTVFzb0U0OXRKbFFsZHFSa2Zw?= =?utf-8?B?TkpZSm1kOUIwcSsrQlFIbkU4a09rR3htRFVXNExuenFRUFVuL1VLdi9Nd2E3?= =?utf-8?B?T3Z5M1A3SkdYcG9TNFNVZGp5eHJHUVZYL21Uak5Xd3FQcUZnZkFYTUttbUlW?= =?utf-8?B?T0dhdUU0bUc4UHB6VEJKK29ZcDgwdzJNN1BhWC9uc2lrY3ZsQTdubGJLQjNX?= =?utf-8?B?S0ZrcE1zUkwydmZuOHZyanZSYVdXLzNlbFViOU9JekkzQ202amk4STkvc1dF?= =?utf-8?B?NnZLbWt0eUlHUHZHaFIxaDZVZTRabTZKUnF2SU1qVzA5NzF5UURUdy9obmh2?= =?utf-8?B?MkU4RkZvN013QTNvRGNBK0NYRHRja0szWlk4L1ZWSTZjaGV6REQvR2hUQkZq?= =?utf-8?B?VlVRUVpQYUhpWEZWVXVsaUN1UzRtS3JRVFhPL3U0SkM3QXp1NEhmQnFRR1lT?= =?utf-8?B?clFySW0xVFJwSTNDVHk2elJYV0d5VllmTkpyUThsaG41ZjZYN24rZks5MEhs?= =?utf-8?B?QU9HZG9ZOFVxbTdlOVNsc3hVY2M1MXJkOWRITGVwTmhPTS9YZ2M4SXdOKzNH?= =?utf-8?B?QXNXaVpSd0Ryb2lJZ09UQmVaK0JPOFY0MUhWdVowaFNMM2pvMnFldGcvSnp2?= =?utf-8?B?MmRNb2lNc2hZVjFML0w0ZjZOcXMzbkZtSVc2Rk0wUXZLTSswaG90NFJQSnpo?= =?utf-8?B?VTdnbzEvSWIxM3lBblpsVS9USXNROEQ1azl6YVpncGZETVZyTmpHVEt6NnFE?= =?utf-8?B?c2Fsb2lCYjQxOVNkaWd5UlNPdURMQW5XZE5TdFI5Y2FMMnNoTFhQQWdOTnpD?= =?utf-8?B?RkUvbEdURFdqcGlFTkVxdDhOSWlJaUUvckRLUnJOU2I2SHA1eFg5dW5aNG5y?= =?utf-8?B?cE5YRUMwZ2xJZTYwc2lPRUFqZC9mVHl4dzNMWFdnZFNFclFLWjZKUmtjN1NM?= =?utf-8?B?cWo4RzBLSzJIWFJPd1YvQWpoVkpVa0ppSEl2RHVTSWszdVU5dlROUUYvcTU5?= =?utf-8?B?QUowYm5HcW1BQ0RkNGpXbFB0UFc0cWNDdkUwRlVsK0swblhWc0poT3dvcFBO?= =?utf-8?B?dDVGa3dVdEJpeVNBU2M1cEl1d1ZqMDhTTzgzZmlPeUxBS05ZV3hMSVpvSFZB?= =?utf-8?B?ckJCaHJlZXZxaVFWYTdyU3U0dzJIRG9BRUtpcG54L2JQK2JmMTlELzZNY25p?= =?utf-8?B?RmZuOUF3cVo3dzBBa2RlOTUzNHNjeTJQL1RzenVWbXdkSENyMEpnUjVKR0lP?= =?utf-8?B?dERCV08yNHM1VXVuczNpMi83ZkZ0YjRQSlF0ZnFQemtYamdJbThjOStJR0Jx?= =?utf-8?B?ZlIvQXZzNFFXcHBJbjBjODBkdGJqV0NGM29RRzdlOUVKdnNrOXgvdGQvUElD?= =?utf-8?B?NmpqSjZmZ0Nzd2FYNHFkZ0pJaVlaMzRQVlNJYjRydnMzMzMyczdzbzRVK3dv?= =?utf-8?B?czM2bkdPRWF1T1RSY3FlbFZtM2REeHZaN05ZKzA2OFJ4Q0E0clJldGJGQXdS?= =?utf-8?B?MC9uMzBrSVM3a2dUVkVkaFJtSm42ZGxmTVFFbXgya09zOU8ralhkcjZ2Sk5r?= =?utf-8?B?cEllMjZ2MjNzYXdqWHpTbVh3MU9zYzdFS2tBSGJIZVhqT0dSQzJObDVjczZt?= =?utf-8?B?K1JPVmNEbC9qOEIxd0VUaHBRODdUYkJ6UkRic1c2NW1KTnBBaVN1MGc0M09N?= =?utf-8?B?ZkhVZDZHOEhXNXlsV1lFTUF0K3c1YmNuaVNpN3U0YUVheUt5UzJVdHpjR2pi?= =?utf-8?B?SHpRUElIWWg5WVBKdmwzNkpiOTNveFdZSnptU3JPUXNZc3JtbUZIc3N6VWhF?= =?utf-8?B?TnB5QzcyWlpZM0N5S2o3TDgrUXJIR1Q4dE8zc29Rb21hQk1QeDQ5WU5rOFMw?= =?utf-8?B?b3NlYnVFcWlmRFZYRG1QVUVJREpjenNWakpQRFg0MzhGRWprRUNxRStQMGEr?= =?utf-8?B?TnZGQTFqOVB5R1pOQ0VYWCtzN1dpZTZRbUNvMDErQ3Bmci82VFU1VURzK1o2?= =?utf-8?B?MGU2cTV5dURpMzBSSjREMHFURXdiT2tWc01QdUlkcFlwRlU3ckxCT1lROWNL?= =?utf-8?B?alkyRGlTRWpwVXowaDYxMFJTTks3UlZWaXRXWXdCY3RXbjRzeHovQWV0VzUw?= =?utf-8?B?QmJZU1Z1SDg0WE5nQ1ZISmdQVlZzdVFpdzNKSk5Va2lHcXN3SjZaOEFzRm9F?= =?utf-8?B?RGJ3bTVkc1liZnlOWCtRVGU3bHpxdDFYUGQ5ZGRnaTFDTE1OcEkvcCtvSDVH?= =?utf-8?B?dk1kY2lTOWI2cXZyTkptalF2WU9jRVJSNkFOYTdCS3RveE1Wb3E3QlhXR1JU?= =?utf-8?B?ejBSTnVlaXFKYVNUT0IvQ1dMeUpWQ2tJcTRKY21uR0NEVGdmbEFoU2xKT3lH?= =?utf-8?B?QVA0SkhsNmFTcXNsUEpqRmlXL0tCZm5TVFNCbEloQ0MydlpRPT0=?= MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: QEMU List-Id: From: Marc-André Lureau The qxl_phys2virt() call for guest_monitors_config only validates sizeof(QXLMonitorsConfig), which covers the fixed header (count and max_allowed) since commit 8efec0ef8bbc ("hw/display/qxl: Pass requested buffer size to qxl_phys2virt()"), but not the flexible array member heads[]. When count == 1, heads[0] is accessed without its memory being validated, allowing a guest to cause an out-of-bounds read. Include sizeof(QXLHead) in the size passed to qxl_phys2virt() so that the first head entry is validated within the guest memory slot, preventing guest-visible memory reading. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4027 Reported-by: Tristan @TristanInSec Signed-off-by: Marc-Andre Lureau Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260715072722.1643289-1-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 9f436938c52125324e36cf9c13b877aa8aada096) --- hw/display/qxl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 7cccfa405d0..a6eea18730e 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -275,7 +275,7 @@ static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay) } cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST, - sizeof(QXLMonitorsConfig)); + sizeof(QXLMonitorsConfig) + sizeof(QXLHead)); if (cfg != NULL && cfg->count == 1) { qxl->guest_primary.resized = 1; qxl->guest_head0_width = cfg->heads[0].width; -- 2.53.0