From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DBBPR08MB10625.eurprd08.prod.outlook.com (2603:10a6:10:53b::18) by PAXPR08MB6942.eurprd08.prod.outlook.com with HTTPS; Thu, 3 Sep 2026 20:26:17 +0000 Received: from AM8P189CA0008.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:218::13) by DBBPR08MB10625.eurprd08.prod.outlook.com (2603:10a6:10:53b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:26:12 +0000 Received: from AMS1EPF00000044.eurprd04.prod.outlook.com (2603:10a6:20b:218:cafe::3f) by AM8P189CA0008.outlook.office365.com (2603:10a6:20b:218::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.11 via Frontend Transport; Thu, 3 Sep 2026 20:26:12 +0000 Authentication-Results: spf=softfail (sender IP is 99.81.216.78) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning openvz.org discourages use of 99.81.216.78 as permitted sender) Received: from nat.eu.perception-point.io (99.81.216.78) by AMS1EPF00000044.mail.protection.outlook.com (10.167.16.41) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:26:12 +0000 X-PERCEPTION-POINT-VERDICT: CLN X-PERCEPTION-POINT-SPF: X-PERCEPTION-POINT-SPAM: PASS X-PERCEPTION-POINT-SENDER-IP: 2a00:1450:4864:20::42c X-PP-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::42c;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42c.google.com;PTR:mail-wr1-x42c.google.com;CAT:NONE;SFS:(13230040)(3072899012)(12012899012)(2092899012)(6059299003)(43022699015)(82310400026)(13003099007)(19002099009)(5063699009)(10067099003)(56012099006)(55112099003)(16102099003)(22082099003)(18002099003);DIR:INB; Received: from AS8PR07CU003.outbound.protection.outlook.com (mail-as8pr07cu00302.outbound.protection.outlook.com [40.93.65.50]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id el903u264v49grv6jgmrg03ooojrmn347lfsvs81; Thu, 03 Sep 2026 20:26:09 +0000 (UTC) X-SES-Spam-Verdict: PASS X-SES-Virus-Verdict: PASS Received-SPF: softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.65.50 as permitted sender) client-ip=40.93.65.50; envelope-from=den@openvz.org; helo=AS8PR07CU003.outbound.protection.outlook.com; Authentication-Results-Original: amazonses.com; spf=softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.65.50 as permitted sender) client-ip=40.93.65.50; envelope-from=den@openvz.org; helo=AS8PR07CU003.outbound.protection.outlook.com; dkim=pass header.i=@openvz.org; dmarc=pass header.from=openvz.org; X-SES-RECEIPT: AEFBQUFBQUFBQUFIVXp0bzFpS0JrL1hlWDQ1bHpySHcwZTBBUCtrQndNb1hvNjVhajNjZVo5Q3JMZmRIQU5MRm9aVHduaURrUWZqMUhtQlk2YjgxZnk0bm0zRyt2NC9NUlNtNk9wck9lVzFrMXdtZHZUZXNaRkNqanNmc25yZkhVMHVUTFpSOTVRNWczRnM4U2s3QkF1bU1wc0IxbXlkbytMTlNVWGZ0NzdjVVJvWVFVSFVqcDAyaFFTVWVGdVVUd2hDdGxxQnVQWWhxR000MVJodHdFdDRGaGtLWG9GRjh3NndWcXZleC9kd01DcGREV2R2amJhVXMrOGYvcUdmaFRwSVMrOW96M1N6S3BVWXQzQmczWW5QMGt4b092SUpJQTZ2eWpOZXNoV3p6T2dMUXUwTlNxTlE9PQ== X-SES-DKIM-SIGNATURE: a=rsa-sha256; q=dns/txt; b=6FVzuomNJbp38Ye0gAXVMgeZaYWbq6yd8UbljF/9mMmQ6QSmFqdPZ0g4fXRigE9R3bBWRljyT6eGjewIKmcwZhknJRfS7quPb0EqsacWaAzy8nGDXWj9wxx7xs3lh0ty1IEngmii10efnGg1MMgKXmngXWK1zNpKzlXlK6Orubc=; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1788467169; v=1; bh=IA7DxYpNC3023i2R8mC6S08J29ZRAC/8EpI5kpIk1Jg=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT; Received: from MI3PEPF00004E9A.ITAP293.PROD.OUTLOOK.COM (2603:10a6:298:1::456) by DBBPR08MB10722.eurprd08.prod.outlook.com (2603:10a6:10:530::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:26:00 +0000 Received: from MI3PEPF00008483.eurprd02.prod.outlook.com (2603:10a6:298:1::6a) by MI3PEPF00004E9A.outlook.office365.com (2603:10a6:298:1::456) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:26:00 +0000 Authentication-Results-Original: spf=pass (sender IP is 2a00:1450:4864:20::42c) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::42c as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::42c; helo=mail-wr1-x42c.google.com; pr=C Received: from mail-wr1-x42c.google.com (2a00:1450:4864:20::42c) by MI3PEPF00008483.mail.protection.outlook.com (2603:10a6:298:1::6a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:26:00 +0000 Received: by mail-wr1-x42c.google.com with SMTP id ffacd0b85a97d-4843e397f74so328414f8f.1 for ; Thu, 03 Sep 2026 13:26:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1788467159; x=1789071959; darn=virtuozzo.com; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=I6R1ZYWh0LEes3S+0awNfoi3K3r07gSRQfyt4C3PJyY=; b=CgQ9lLpa1eoeJdDOy6S9PymYJ2MjAu0jp/v7oak+wzQnJv32jgMPXdOQak0412mC8W 0PKmwixBHUFT2BYNzafAsKvMnOLlxBLmI/Bv08R/q02tVMmIZOnKyky3fJkXgAA+QOC2 fIo818USGgJ60IaZDbNDs61ceBeO8tEYuzlF9auI85lSwqAgV44c40jJoEiwU5+Niaz9 TF+U6OhTDJ6xSwSyj6MYR4tdK9xJxKkJp8utPSHQQI1UpsfNbMQbZJ0sFGf7hMTXwq9c +TzHgYTB4EWh80bZfrcUOL4bupKlcwQe4ECINgGAFm3JN1ocHdz15aCcxXKXtsZ25ePA u2wA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467159; x=1789071959; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=I6R1ZYWh0LEes3S+0awNfoi3K3r07gSRQfyt4C3PJyY=; b=Bbe6W7ChGZsXlkspDLTCr0a4ErlQKX1mhw5/oQSdCV8ueDDUaFpqmnO6omPGoVC5ZT m7+7/LGHVrC3F85C29Tc1+2m5kodOR0LH+Gbe/QOuvml2gBFl2a+tYHsrJo6Hj0nFJMo zLBi/MStdpWgIBXf4kBe2E9xh1a1H0qZ0AM/Uj33nmF0LkDWPur/nD6j0yq0Q6Ez8Bhy CZeCLdl31+FKAybX7Q0qw/FySPK1yL+Fz/eNt4c2mlMqD2oZDkQhkw3rvtRNB8yMwjoo wr/HGUMiuKksatQWaxq0j+fG3s4NkX61HO0ZP7kxGRYPOHGsFJn5PMSWoOmmxbdUTG+N gSsA== X-Gm-Message-State: AFuF++mVbdOT3no1vV4qn1H5/zpSdYcUaiipcHOGUooBLZ7R1wVVNZTw Ke/1UMCity8VPhSF8TI/9Hq5yVquxPXC/QQccoRvn63ieHjG8SqVoTiZm94aVLXz5O1ddL1ahT/ CVcr6YB8= X-Gm-Gg: AYBFou34osQTQl/Vxr0/gQUVIJNVX+DjBLEbM+a5BoSQFYjEdbRfu7/dYu3+W0rlhH1 9BjzenjCOK967DfZa7DKDP0qWfZ9XtSzWTkVeRLHTzUam0IzlbjeEoYGUBLXs16kaNJ9Pb2kwo7 eGNIZK3CmnhCTV8nWgnZTlvx2c5o6LiD1A7yAncueYnbQLcgZ6Th55nBO9bCp6gq1TBpaKsCjYP D2vUMHeXhw8ILb0gnFfpQu8UjXERi06B3dA16qRM9fOvU3sw31In8kfYXOcTdJoW4zf3h8DxVw/ KO6fF3dnuXUSxqYcDUbdvFi4AB2y+VkLFj3yRCzdbBT6tlta3et/IUDcPosu4YxoFnncrPQu5l/ 2bw2A0MFoNLytwEIB8+vxg6gG3KDMvgszfMfMRUxhHcVksMIGQVH4d+NByH82KZErsPBtaXYj26 klDqJYcfLvezHS+xcoQnizUq9MyAEXnJ5vWDH5Jz0r0Mg+yLG7/U9bcJae X-Received: by 2002:a5d:6d2b:0:b0:484:3600:35a9 with SMTP id ffacd0b85a97d-4857e3ce195mr9495850f8f.3.1788467159438; Thu, 03 Sep 2026 13:25:59 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:83cc:ab98:cda9:7dc]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm950600f8f.8.2026.09.03.13.25.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Sep 2026 13:25:59 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: den@openvz.org Subject: [QEMU HCI-8.0 PATCH 7/7] hw/display/qxl: validate primary surface stride against width #VSTOR-144000 Date: Thu, 3 Sep 2026 22:25:49 +0200 Message-ID: <20260903202549.2754937-8-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260903202549.2754937-1-den@openvz.org> References: <20260903202549.2754937-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 1 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:1 X-MS-TrafficTypeDiagnostic: MI3PEPF00008483:EE_|DBBPR08MB10722:EE_|AMS1EPF00000044:EE_|DBBPR08MB10625:EE_|PAXPR08MB6942:EE_ X-MS-Office365-Filtering-Correlation-Id: 31eb2cdf-107f-467d-2b85-08df09f998e2 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA|SL X-PERCEPTION-POINT-CUSTOM: vzpp X-Microsoft-Antispam-Untrusted: BCL:0;ARA:13230040|3072899012|12012899012|2092899012|6059299003|43022699015|82310400026|13003099007|19002099009|5063699009|10067099003|56012099006|55112099003|16102099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info-Original: =?utf-8?B?MWwyTWpZU05QbTBNS3NtZVpVRDJrbUF0djdMNkI3a1c1ekI0S0djQ2tOd1FC?= =?utf-8?B?bkYxQ0FTS1dPVy9vRHRKSXh4eUdRMVAxcXZ5b0o2b0FQMGRISlhvRmdoUm5j?= =?utf-8?B?U2Z3dTFmbmNseWQyV1ZXUVlSTHU2MDhjay9SNklJNWpYMU1lY0VTL0VCREYy?= =?utf-8?B?akxrOWd4emprYXVoUkpiTFFzZ0MyQUNqU29GRVB6RklGMGIzRlVORER1enV3?= =?utf-8?B?dHFSNUU5UndQcVRzYnVjS3lRd3pQRHRSNmxTT1FkZzBtMk5UdEFBQmYybytY?= =?utf-8?B?azNKOTA0WUJxaC9zK0VGdnNsVkp6RmNYaEx6eGZYTzV0VE1QQ1JFZW1Hdmk3?= =?utf-8?B?VFBPWG44QkhXekhDamtNOXJtRkZtaFlmWXI3UmZMa1FqaEpSdE95bG1mSVZp?= =?utf-8?B?dlQ0U2VUQjg0THJmQVpRWk80RVlaWG0vK0JkR2lBM2htQlNIdnR1Z1dzUTMv?= =?utf-8?B?ZkVWamxhdTB2QzdXa2x3TFdjR29MODRVT04vMEM5dFNrYWlhVnlyYnBXVmhS?= =?utf-8?B?alA0MGVVOUdMcmFqNmZsdktNREZzMWl2YjUwRXlrMkNEQ3diOU1kVDVRNlRQ?= =?utf-8?B?QkhoVUNxYnhhejVjYU0yQldYa3hRQ3NqOXNwekMvZ0RoQ0kreU51R1ErTjlZ?= =?utf-8?B?S3RRRGZ4bTRuVHZLVG9NYUNtbXJ4QVlRYmNYWE9OZitLZWZBNzd3OU14dUQ3?= =?utf-8?B?Um53M2pmRC9VS212YW0wNWFCc0MzU0cxczVKaHR6SUdqR0RZRm9uaEh4cWEx?= =?utf-8?B?OElZNjRIWjQvOGpPbi9CYmJETXNIRXZyQWdTZUxjRFhaZVJqbDFYNm1VL2Fy?= =?utf-8?B?aGZaMFZBb1VJb1RCVW9aSmVOUHRWOHR2NnAzWlh2TllSYVFhQk9OTmh6Wnpu?= =?utf-8?B?UG0vTFpJMzlvNGF4bmZZZ1k1WGs0T3NpbEJXWUJCeWJZaWlHcGFBZ3dVL3Yw?= =?utf-8?B?VjhyeGhmWlVaRUdxVFpOK1MvNFlybWpPakJTVTZocnY1VDZ3SGcyR1NMaGFP?= =?utf-8?B?VUhhTFpSdi9pa2VBK1krd3NjTWo5SnI4Z1pvY0ZtZld2ZFRCcHNXZlZ0Rlpn?= =?utf-8?B?eHFFaXNjOXFCN1JJYWVkMFhVVW5rMy9URGVoZzZDbDN4dzBNRzM1VFFTZTV6?= =?utf-8?B?YU8vUy9YdkxyNGlCYXhNV2NUeXJ1NzEvMjVYZzZtS3dUQUw5L1Fxb3lZaTY4?= =?utf-8?B?WGpUOWQzdTIwbDgrVDJQWHVOSTRVNzc5TkN2KzZCTFJ2UThrVEpnNjVva2ZF?= =?utf-8?B?UXAxVVY1NXhWV3hGVGFEbHM5OGZQN3kyODRPNGw3T1kxdDd6MXdRRkhJVm9Q?= =?utf-8?B?V3RmQ2FGdTR6bEc1RDBsMUZwVzdIVHY4WGcwVGs2ejdHdHlIeWlJS2QwRWNT?= =?utf-8?B?MGsxQ0ZSbkJqWUh4QjRjQnV4MnBoTTVQaXNwUERkQTlTMk41UmFIVklhbjl0?= =?utf-8?B?OEFnN08zNDdEUkExWTErazBpMExXK1NURWE5N0VOTm9YNEpYUjVmZ0wvSUhV?= =?utf-8?B?b3p5ak83c1VCU2tGU1Y4UGJocnBEbWtBYzNEWG94SGIrNktQdS96dnpSa08v?= =?utf-8?B?aHR5dkVzZFVmSFF2K0xiSmpFU284WTRHUDBEc2I1Qkk2bndzTTd1b2V2cGow?= =?utf-8?B?QXd3WlJLeENJYzVxb1ZmeWFkaEpQWHFtbTdqOWFQcUtnNHVkaFlqSG1hS1h5?= =?utf-8?B?RG9YZ2l3ZGNJR21jb0VVUWk4RWJRbnNLenJDZWNqRE55VzBjcFdOdk9wM0p6?= =?utf-8?B?ang4Q1NEMFZpUytqcWl5YkFyZlNySVphbms4WFVRZjBMSW5uN244ZUlFck1j?= =?utf-8?B?eG93WFJRUG9YY3EwWm5rNjc2bnNZREtoVTdYck5YL2ZFeUJFSGVSeDRacC9t?= =?utf-8?B?YTRIdlJLTXJ5a2Iva2UvQzNWc1daYXRtbitxaEJnczVWdHRMQ3dRcEFFaFFS?= =?utf-8?B?R3VUb0YrRHdNdnVpaStoRnErUUxVS2JKUkgraHBOcXVERlBUanNsN25Zcmx0?= =?utf-8?B?TXhMMWZPb3ZKd0VtbGxzUVdscW43VmlvZzNiOFRZY2VaYzBwQjhlQXVJNlRl?= =?utf-8?B?TXRuRmRJcjZwUlN2ZnMwTTFLdWN1ZkxBM1VqbUtzSzRiTSt2bkd6UEZSNngx?= =?utf-8?B?clRFVWpqazM3aDVTZzNjN21TQ3hJSE5WN0JzRExBVnAxd0ljSTdwZHQ5Rnlh?= =?utf-8?B?QkVwT0t2S2g2dGY3KzFwOGJtUmhialVpSTU5dHhUSk5mRHRoQzdNRTFkbmR6?= =?utf-8?B?aENTWHZvZEpIZGI0OTAzZ1BrcEs4endlaVE5dm5EL3RPVkJEREFXcDhuNHlm?= =?utf-8?B?V1Z5UkwyME5QalVrRHBKNXAzQjFvVk5QRHo3bjk1dStqbWVNQnlaMjVHZ0Fv?= =?utf-8?B?dnBLcDU2QUxSejVVWHRMdC9LaHBMUmZORy9Mcm9qNmlBYUQrTnQzMGIvbHdm?= =?utf-8?B?RFBvZGhKZzZkaUJjNlVvZi9HOVBDUlBoRDk3UHFlMG5XQ2sydERZTTBkV0J2?= =?utf-8?B?NVFhOU1ZNlpQWDlqNmFVNkR2UjNnRFYxNjVoR09oenM5ckpzYUF0Wi95Rmhn?= =?utf-8?B?aFFLWFY1SWkzY09pc3dSVkprblVkd2pSbERHY2hzY01lMkRKc0g3WHNManpM?= =?utf-8?B?RW8yWUtlUDFCblF5UytwZlBuRzJmSHZ1WXNDVCtpS2RlWmtibVBwTkFpUnQw?= =?utf-8?B?MVpzbFhGbWNtVjdjNXVRd3k0VXBtTFpWTUxSRVBLSzQ4Z0F6SnhvQ21sa1cw?= =?utf-8?B?eEFQTFRxWFJkRFo2OUpmLzF2bk5MSjM3eUg5bHZFRlVlOHdXOVlpU0NrUWhY?= =?utf-8?B?TlhscVlCdzVDcjU2K3lvS1htOVNleGltbEZpcktTY2J3NG41dVdRcUFrUFoy?= =?utf-8?B?ckJ3bTlGSDMzOWdMWXNKd0JpeUJMM1RrdzhsZDVUei93bnAzaVl6WW4vY0VO?= =?utf-8?B?VnRybmhtT3NGazU3cDBxYXJudU9LcSswWjRxTG5STlNQbWtjNStrUGo3TWRP?= =?utf-8?B?MmM4a1JWWnRuUkIwRHBYMFZyMWpJeEhQSFJPZklObHVTSWtYaEtRWmx3Nis5?= =?utf-8?B?blBOZWFBTG5VQTFBPT0=?= X-Forefront-Antispam-Report-Untrusted: CIP:2a00:1450:4864:20::42c;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42c.google.com;PTR:mail-wr1-x42c.google.com;CAT:NONE;SFS:(13230040)(3072899012)(12012899012)(2092899012)(6059299003)(43022699015)(82310400026)(13003099007)(19002099009)(5063699009)(10067099003)(56012099006)(55112099003)(16102099003)(22082099003)(18002099003);DIR:INB; X-Auto-Response-Suppress: DR, OOF, AutoReply X-Exchange-RoutingPolicyChecked: NqLYUtLv0e/Ohrkd1dYGtlF7f7dWWML6pn/VC2SGIIAr7C03xyA1FXnsVK1ii48lN+tstMBZz9Ad3AeeO0O2cv/4u+uCQp/VhydQeHrIa/8/csKLPYREK7aP0MWgi2wDxfMB3Fu9OiH4FCmEPex13tuPPNX6wrirO0pvTkqf+lmRwkGQvbkTgqeHLcf545mnPVgtcV4DHypQgJ9yWNGQKtbFNF/ZhAY/cizMzQnQ7NRinxHSsipBKjO5N6htld46IbVDbZvoW0QNkHW/y7C8tB/4MHUehTQVMAHASaHv+VtgYun3zVjpZpWp5GHqXc2z0rv4acg91wJN2vlrUGUG/Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB10722 X-MS-Exchange-Organization-ExpirationStartTime: 03 Sep 2026 20:26:12.6365 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: 31eb2cdf-107f-467d-2b85-08df09f998e2 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Transport-CrossTenantHeadersStripped: AMS1EPF00000044.eurprd04.prod.outlook.com X-MS-PublicTrafficType: Email X-MS-Exchange-Organization-AuthSource: AMS1EPF00000044.eurprd04.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id-Prvs: 94482b1a-e90e-497c-f6ef-08df09f99170 X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230040|35042699022|3072899012|43022699015|6059299003|2092899012|82310400026|12012899012|57112099003|18003699003|10067099003|5063699009|5133699003|22082099003|55112099003|16102099003|13003099007|19002099009; X-Forefront-Antispam-Report: CIP:99.81.216.78;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:nat.eu.perception-point.io;PTR:nat2.eu.perception-point.io;CAT:NONE;SFS:(13230040)(35042699022)(3072899012)(43022699015)(6059299003)(2092899012)(82310400026)(12012899012)(57112099003)(18003699003)(10067099003)(5063699009)(5133699003)(22082099003)(55112099003)(16102099003)(13003099007)(19002099009);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Sep 2026 20:26:12.0090 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 31eb2cdf-107f-467d-2b85-08df09f998e2 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AMS1EPF00000044.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB10625 X-MS-Exchange-Transport-EndToEndLatency: 00:00:05.9187214 X-MS-Exchange-Processed-By-BccFoldering: 15.21.0382.004 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003); X-Microsoft-Antispam-Message-Info: =?utf-8?B?bEZua0hYeXdUQXQzZURqMkJxbjhTU0hUajFyVVd3UUlwck1odE1FQ013N2U3?= =?utf-8?B?Nnc0bTZKQlRRUDhTNW5PUUNsQVJtMUNwZ05HdE5TeHU2TExSVXFXTzNaeS85?= =?utf-8?B?QWtxbHUyWFpRVzBDK1JqZWlIcHVQeTZ5RHE2cGhCUmdkanlkd3V6ZE91VlVu?= =?utf-8?B?bzB3eDcycVpUOTdLUmVyT0FiV3E3dXhoKy92WkpJdjZqbEwrd1ZlR3VWTXFB?= =?utf-8?B?TWxiaEozYldSWUoyTC9mSzdMRC9RbVZwejJ0RktpaFEvdjdMdDRwbTJraFl2?= =?utf-8?B?em5BV0lnYnpxcTdhdGhZRFpCblJkb0kxcndaSXJXNWtGdU9MUWMyM1Q4S1Rk?= =?utf-8?B?QkQ2QksrdjlIdnF4Q0psMkNQeThqZW5GRmJLZ0JsNWdlVHlBY0t2blNxc2di?= =?utf-8?B?YVZmTlNXQUE0ZXJic3EvaUN0eWlLRzJzU1pYMDVLRUpOaHlnQ2h1WDZpekZW?= =?utf-8?B?d3lzMzZMMG56WnBoaXBwOW5DUkt6aHVlQTJGeDMvQnVsTzhFK3ZEU0hQc1U1?= =?utf-8?B?am5GbjNJYVdkNWhLNnhXK1ZDSml4UUx3OHEwY3RFOC9TN0VSaXpjRGNMdnRh?= =?utf-8?B?SUdVTXNtUnZiN1pQdnV6dE1WTTMrZ1hxVzdPcWZSenhXckZDNnVManBWU1RO?= =?utf-8?B?ODc3YUxnTkYxRHEvRitvUHpGa1BvVTgrY0VsYllNeVAwV0VlSkQ5bGROMUlM?= =?utf-8?B?NUtzeXRPTFZZSDFlRHcvS09jV2xaamw0eHBuWS84aU95RjF0MStackVuVmd1?= =?utf-8?B?bFpRNjhyUVJyd3Q5T2FtTHNZR2VQQW8zQXcvamNER1BkTFFuMzdGSjlSVWNQ?= =?utf-8?B?UDRseVJlZXRva2Ria2NKUVNXUm14S1BqZmxGSnJjZmd6d2U5ZWxHSkxlcEo5?= =?utf-8?B?TjZMUC9JZ25wQXp1NWgzQTY4MGo5QktTeXdrM1NNRnhYLzdkTndzR3gvak94?= =?utf-8?B?SS9iOHZRdk5vT0pMTW84TU9EMkEyNkFWZHYvMVJzT00rNkhOR1k1WnVnYkxE?= =?utf-8?B?d2xRUzBCcTZmdUs3d1FpaDhJOXA5NHMrYmNBOFB3QzBFTUhHTGVtRHQzV2hZ?= =?utf-8?B?L2V0Nzh4Rk9XbmpQeG0yM1d4blQzUDF4WUFuS29IVjh5UnVZNFlEYzdTUlBO?= =?utf-8?B?Z2hXYnJWb3J5UE1KYkc2S0xrb1d5K3RFL2EyMWNBY1UyWXZLODlhVFNXMVFQ?= =?utf-8?B?d3dSTkhaQnRNV0VjYTRBcjdQdjRQUXJtN21pdWx3NFJHcWFSTVdhK3hYbjFk?= =?utf-8?B?MEN5TXphRHgybnU5anBGNjVDN1BocVNBUHc4VFdFb1ZkYWZhell6QUF6MXN6?= =?utf-8?B?eG1tTWwrR2ZDeGljd3ovM0dOSVlvYXZIeUxsc1FmRXJuT29vdHdnRS9vakZT?= =?utf-8?B?VmNmSU9rT2dZMHhaenJINTJycTRJc3phWFhzakFsNmtZTnFsaVQrdVZLa0hw?= =?utf-8?B?M3dZTmFleEdyMzZzUGNkZjdPNUF1YUMrellQSVptUzFVQVFaS2J0NUY4eHcr?= =?utf-8?B?U3h5c2g4b3BtZkJTR3RtTG55MlByT0t6akRudThFVzBYOFJxb2lRRm1ueXBl?= =?utf-8?B?dVRYdVJrenZqd0UxTUtCTjdFOGErcGxVUGpoQ3dLQ3F6SjNNblVzb290WHlF?= =?utf-8?B?NFNvbEpUM3dEWStEUGJsYzJYT3pLZVZ1UWZTU0REcTM4dHhVcURubVpWS0l4?= =?utf-8?B?elpydHdSU0xpNFNmTGt3RlMrWkdJT0hOQUE4YnFMK0hUZUN3UmFvSmdvVzc2?= =?utf-8?B?Rm5PbkFCV3krKzFWM0tVdmtReEx2aC9pOTE2M0NBNUUyeTlYbVJFekgwMUlv?= =?utf-8?B?eGh5NkU5OFJTT3g4RE0xUWNscC9rZk5uaUxRcGJsczlTZzVTOS90eE8xd011?= =?utf-8?B?bUZ5TGVad3NTSGJuSlV3cERiMU9Ca1RvK05GV2dsZ2d1eGVMQUdwblZVcmRQ?= =?utf-8?B?R3BSQjRZMEcwQUlUUC9EWU14bisvQWZCakNhQnlqcytuY0J1aTJwYjI4N3Vw?= =?utf-8?B?NnVuQmk4Nk9kbEtqVi8xYmhkL1dEZVlxcGlaWW1WNkxxT2QxdHBCeElVdGc2?= =?utf-8?B?RXQzVGFHRXdaMEo3OEp5bUp3bDZUZ0dabXdXWVN6MVJPNlVWd2hMK3pTWWFZ?= =?utf-8?B?MlFOVXlUZUhMejBlTU1zUldONURvenZJLy9NaUIwYVRUT3BSd25mV2xNWXd5?= =?utf-8?B?S2Z5ckNzSGZCbXpTaWx5SldjUzBnSmFhMHRYdjZFc09MQjZoL1ZFYUVKRDJu?= =?utf-8?B?M0thUnVxWlcvZHgzREJQUS9hSzJ5MEl0WTJUVDRIMDVNSVd0YjhSbEhnanFp?= =?utf-8?B?Qk8xR0hVS29Vbkdrdjl2dEZhMGFzNjdRZzl1MWhvTHU3c0dZODByd0VIZm5Z?= =?utf-8?B?SkpKSW0wR0Y4aUhMbW9rUi9zYnhlV0FaQTkwYkIxbnlUZHFmcmp1UHBXaWhR?= =?utf-8?B?MURxdDZVYkNlZmhsL2s1a1d6TGJXVDlCZUwvVVlTV2RmUlV1Z0FhUE9Uenpk?= =?utf-8?B?UWpmeUxmdUYwbkMxbVlpQnVhc3EyWWZ3d0Ntd1d4WGtpRm5QVW9EVm9jQ251?= =?utf-8?B?Z3dieXRiS2NjdzFSV2xMRWVYbWRSaDlZR0MraXRjTTQzQnB1c1ZROW5hR1NZ?= =?utf-8?B?V2Npb2luRlROQXBWbUh4WEkwMW5TalJQMjJGeEtoeGI1YnhJU0lpeDlhaGx3?= =?utf-8?B?b2s1ZVFtQ3VuWVZuT09aM0Jvem1zaVRaR2V6ZnBZbW9qSVhwYU9NT1hKNUpi?= =?utf-8?B?V3lRTDdudnJzVjJxbk9CZnM0RUZEWUxEbVlYL3lmeXhTaDNyUjd1akE0TGls?= =?utf-8?B?MUs0WlR5K05wSkdWOG9EcmVKbFFHZFZaYnI2WHducy9nOG9zc0FXUUkzaFN0?= =?utf-8?B?TWYwNHRNalhDcDRBOVkrZHhYZVNnUmJsUTVyd0lvdnlLdWd1TWhDT2lNV1pl?= =?utf-8?B?d1JDaVNyb21QUDVkOFROWGdkRlduN1ZldnFmM3FXUndlSitVNTlHK093Undv?= =?utf-8?B?YWVyOTZhSzd6Nzc3T2x5UjQ2LzJIRW1VZHBNcGxLckRDeDFUaW1weWs2R0gz?= =?utf-8?B?TUxUWGgyaVZydENlR0lJRXlPQkQzemhHWDFhakJBUk1PNlUxL0YrbGczdXpz?= =?utf-8?B?Ny9yM2NQVFhxV1lFa01wZnA4cjdxbHhwMlRrOTlYK21QQVhtTE9FZGltL2Rt?= =?utf-8?B?eUNFdEVwNVFmVGJ0STVXVldnYzFOb1QwcTF2VW1LYlc4aGZlKyttQk5VbXdu?= =?utf-8?B?S1h5b09nZnNGM25oL0lVS0o3QXRTWFNBWkxUTjdjM1dTSFQ2bHpoMlJLOVBE?= =?utf-8?B?bEJ0SFlKanZKNk5DNnlDZTBJRk1UVERxNEVReFVVd2ZOc005YzdkVUFJSHpF?= =?utf-8?B?ankyaWdHMkpuRW02U2VZb2lMSTJvTXdKcjQ0d0IzVGRUZi9rNWZRcUNyQT09?= MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: QEMU List-Id: From: Marc-André Lureau The existing validation in qxl_create_guest_primary() checks that abs(stride) * height fits in vgamem_size and that stride is 4-byte aligned, but never checks that abs(stride) is large enough to hold one row of pixels for the declared width and format. A malicious guest can create a primary surface with a stride much smaller than width * bytes_per_pixel (e.g. stride=4 for a 64-wide 32bpp surface). The spice server rejects this via red_validate_surface(), but the return is void and QEMU unconditionally proceeds to set up the local rendering state. On the next display refresh, VNC or SDL reads width * bytes_pp per scanline from a region backed by only stride bytes per row, causing a host-side out-of-bounds read. Add three checks in qxl_create_guest_primary() before creating the surface: - reject unknown surface formats - reject zero width or height - reject surfaces where abs(stride) < width * bytes_per_pixel Also fix three related issues in qxl-render.c: - qxl_blit() used abs_stride to advance the dst pointer into the DisplaySurface, but when stride is negative the DisplaySurface is a packed buffer whose stride may be smaller. Use surface_stride() instead. - qxl_render_update_area_unlocked() uses guest_head0_width (set via QXL_IO_MONITORS_CONFIG_ASYNC) without validating it against abs_stride, bypassing the new validation. Clamp the effective width to abs_stride / bytes_pp to prevent out-of-bounds access while tolerating the normal transient where the monitor config arrives before the primary surface is resized to match. - Similarly, guest_head0_height bypasses qxl_create_guest_primary() validation. Without clamping, abs_stride * height can overrun vgamem_size, and the product can also overflow 32 bits (e.g. abs_stride=16 MiB, height=256 wraps to zero), defeating the qxl_phys2virt() bounds check. Clamp height to vgamem_size / abs_stride to prevent both. While touch it, fix some endianness issues. Fixes: CVE-2026-16271 Fixes: a19cbfb34642 ("spice: add qxl device") Fixes: 979f7ef8966b ("qxl: use guest_monitor_config for local renderer.") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3637 Reported-by: huntr bubble Signed-off-by: Marc-Andre Lureau Reviewed-by: Akihiko Odaki Message-ID: <20260806094028.640676-1-marcandre.lureau@redhat.com> (cherry picked from commit ab7183ed4eecb4727532e3ffe5953d127e102c72) --- hw/display/qxl-render.c | 66 +++++++++++++++++++++++++---------------- hw/display/qxl.c | 59 ++++++++++++++++++++++++++++++++++++ hw/display/qxl.h | 2 ++ 3 files changed, 101 insertions(+), 26 deletions(-) diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index cf0f6849cd0..f2bc25f03ad 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -27,6 +27,7 @@ static void qxl_blit(PCIQXLDevice *qxl, QXLRect *rect) { DisplaySurface *surface = qemu_console_surface(qxl->vga.con); + int dst_stride = surface_stride(surface); uint8_t *dst = surface_data(surface); uint8_t *src; int len, i; @@ -45,14 +46,14 @@ static void qxl_blit(PCIQXLDevice *qxl, QXLRect *rect) } else { src += rect->top * qxl->guest_primary.abs_stride; } - dst += rect->top * qxl->guest_primary.abs_stride; + dst += rect->top * dst_stride; src += rect->left * qxl->guest_primary.bytes_pp; dst += rect->left * qxl->guest_primary.bytes_pp; len = (rect->right - rect->left) * qxl->guest_primary.bytes_pp; for (i = rect->top; i < rect->bottom; i++) { memcpy(dst, src, len); - dst += qxl->guest_primary.abs_stride; + dst += dst_stride; src += qxl->guest_primary.qxl_stride; } } @@ -61,30 +62,13 @@ void qxl_render_resize(PCIQXLDevice *qxl) { QXLSurfaceCreate *sc = &qxl->guest_primary.surface; - qxl->guest_primary.qxl_stride = sc->stride; - qxl->guest_primary.abs_stride = abs(sc->stride); + qxl->guest_primary.qxl_stride = le32_to_cpu(sc->stride); + qxl->guest_primary.abs_stride = abs(qxl->guest_primary.qxl_stride); qxl->guest_primary.resized++; - switch (sc->format) { - case SPICE_SURFACE_FMT_16_555: - qxl->guest_primary.bytes_pp = 2; - qxl->guest_primary.bits_pp = 15; - break; - case SPICE_SURFACE_FMT_16_565: - qxl->guest_primary.bytes_pp = 2; - qxl->guest_primary.bits_pp = 16; - break; - case SPICE_SURFACE_FMT_32_xRGB: - case SPICE_SURFACE_FMT_32_ARGB: - qxl->guest_primary.bytes_pp = 4; - qxl->guest_primary.bits_pp = 32; - break; - default: - fprintf(stderr, "%s: unhandled format: %x\n", __func__, - qxl->guest_primary.surface.format); - qxl->guest_primary.bytes_pp = 4; - qxl->guest_primary.bits_pp = 32; - break; - } + /* fallback to default bpp if format is unknown */ + qxl_format_bpp(qxl, le32_to_cpu(sc->format), + &qxl->guest_primary.bytes_pp, + &qxl->guest_primary.bits_pp); } static void qxl_set_rect_to_surface(PCIQXLDevice *qxl, QXLRect *area) @@ -101,15 +85,45 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) DisplaySurface *surface; int width = qxl->guest_head0_width ?: qxl->guest_primary.surface.width; int height = qxl->guest_head0_height ?: qxl->guest_primary.surface.height; + uint64_t map_height; int i; + if (width <= 0 || height <= 0) { + goto end; + } + + if (qxl->guest_primary.bytes_pp > 0) { + int max_width = qxl->guest_primary.abs_stride + / qxl->guest_primary.bytes_pp; + width = MIN(width, max_width); + } + + if (qxl->guest_primary.qxl_stride < 0) { + /* qxl_blit() uses the primary height to find the first scanline. */ + height = MIN(height, (int)qxl->guest_primary.surface.height); + } + + if (qxl->guest_primary.abs_stride > 0) { + int max_height = qxl->vgamem_size / qxl->guest_primary.abs_stride; + height = MIN(height, max_height); + } + + /* + * height limits the visible update, while map_height is the guest memory + * span validated by qxl_phys2virt(). With a negative stride qxl_blit() + * addresses scanlines from the declared primary height, so a shorter + * monitor still requires validating the full primary surface. + */ + map_height = qxl->guest_primary.qxl_stride < 0 ? + qxl->guest_primary.surface.height : height; + if (qxl->guest_primary.resized) { qxl->guest_primary.resized = 0; qxl->guest_primary.data = qxl_phys2virt(qxl, qxl->guest_primary.surface.mem, MEMSLOT_GROUP_GUEST, qxl->guest_primary.abs_stride - * height); + * map_height); if (!qxl->guest_primary.data) { goto end; } diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 994bfcaa522..f0cf346c430 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1509,6 +1509,47 @@ static void qxl_create_guest_primary_complete(PCIQXLDevice *qxl) qxl_render_resize(qxl); } +/* + * Convert a SpiceSurfaceFormat to bytes per pixel and bits per pixel. + * + * Only valid for surface suitable for rendering. + */ +bool qxl_format_bpp(PCIQXLDevice *qxl, SpiceSurfaceFmt format, + uint32_t *bytes_pp, uint32_t *bits_pp) +{ + uint32_t bypp = 4; + uint32_t bipp = 32; + bool ret = true; + + switch (format) { + case SPICE_SURFACE_FMT_16_555: + bypp = 2; + bipp = 15; + break; + case SPICE_SURFACE_FMT_16_565: + bypp = 2; + bipp = 16; + break; + case SPICE_SURFACE_FMT_32_xRGB: + case SPICE_SURFACE_FMT_32_ARGB: + bypp = 4; + bipp = 32; + break; + default: + ret = false; + qxl_set_guest_bug(qxl, "%s: unhandled format: %x", __func__, format); + } + + if (bytes_pp != NULL) { + *bytes_pp = bypp; + } + if (bits_pp != NULL) { + *bits_pp = bipp; + } + + return ret; +} + static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm, qxl_async_io async) { @@ -1516,6 +1557,7 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm, QXLSurfaceCreate *sc = &qxl->guest_primary.surface; uint32_t requested_height = le32_to_cpu(sc->height); int requested_stride = le32_to_cpu(sc->stride); + uint32_t bytes_pp; if (requested_stride == INT32_MIN || abs(requested_stride) * (uint64_t)requested_height @@ -1552,6 +1594,23 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm, return; } + if (!qxl_format_bpp(qxl, surface.format, &bytes_pp, NULL)) { + return; + } + + if (surface.width == 0 || surface.height == 0) { + qxl_set_guest_bug(qxl, "%s: zero dimension %ux%u", + __func__, surface.width, surface.height); + return; + } + + if ((uint64_t)surface.width * bytes_pp > abs(surface.stride)) { + qxl_set_guest_bug(qxl, "%s: stride too small for width:" + " stride %d width %u bpp %u", + __func__, surface.stride, surface.width, bytes_pp); + return; + } + surface.mouse_mode = true; surface.group_id = MEMSLOT_GROUP_GUEST; if (loadvm) { diff --git a/hw/display/qxl.h b/hw/display/qxl.h index a25d9865453..ed5f71c0a3a 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -182,6 +182,8 @@ void qxl_spice_oom(PCIQXLDevice *qxl); void qxl_spice_reset_memslots(PCIQXLDevice *qxl); void qxl_spice_reset_image_cache(PCIQXLDevice *qxl); void qxl_spice_reset_cursor(PCIQXLDevice *qxl); +bool qxl_format_bpp(PCIQXLDevice *qxl, SpiceSurfaceFmt format, + uint32_t *bytes_pp, uint32_t *bits_pp); /* qxl-logger.c */ int qxl_log_cmd_cursor(PCIQXLDevice *qxl, QXLCursorCmd *cmd, int group_id); -- 2.53.0