From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
To: svt-core@virtuozzo.com
Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org
Subject: [QEMU HCI-8.0 PATCH 00/15] VNC stability fixes
Date: Fri, 4 Sep 2026 13:11:50 +0300 [thread overview]
Message-ID: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> (raw)
These are VNC CVE/stability fixes, all cherry-picked from master or
qemu-stable.
AlanoSong@163.com (1):
ui/vnc: Fix qemu abort when query vnc info
Daniel P. Berrangé (4):
ui/vnc: fix OOB read access in VNC SASL mechname array
ui/vnc: fix OOB write in VNC stats array
ui/vnc: fix OOB write in lossy rect worker code
ui/vnc: fix OOB read updating VNC update frequency stats
Heechan Kang (1):
ui: fix validation of VNC extended clipboard data length
Marc-André Lureau (8):
ui/vnc-jobs: fix VncRectEntry leak on job cleanup
ui/vnc: fix OOB write in vnc_refresh_lossy_rect
ui/vnc: validate color shifts in SetPixelFormat
ui/vnc: use RFB wire types for client message handlers
ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
ui/vnc: validate SetPixelFormat field ranges
ui/vnc: remove redundant rows computation
ui/spice: fix crash when disabling GL scanout on
Thomas Huth (1):
ui/vnc: Fix crash when specifying [vnc] without id in the config file
ui/spice-display.c | 4 +-
ui/vnc-auth-sasl.c | 2 +
ui/vnc-clipboard.c | 9 +++-
ui/vnc-jobs.c | 19 +++++++-
ui/vnc.c | 107 +++++++++++++++++++++++++++------------------
ui/vnc.h | 4 +-
6 files changed, 96 insertions(+), 49 deletions(-)
--
2.47.1
next reply other threads:[~2026-09-04 10:12 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 10:11 Andrey Drobyshev [this message]
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 01/15] ui/vnc-jobs: fix VncRectEntry leak on job cleanup Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 02/15] ui/vnc: fix OOB read access in VNC SASL mechname array Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 03/15] ui/vnc: fix OOB write in VNC stats array Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 04/15] ui/vnc: fix OOB write in lossy rect worker code Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 05/15] ui/vnc: fix OOB read updating VNC update frequency stats Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 06/15] ui: fix validation of VNC extended clipboard data length Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 07/15] ui/vnc: fix OOB write in vnc_refresh_lossy_rect Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 08/15] ui/vnc: validate color shifts in SetPixelFormat Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 09/15] ui/vnc: use RFB wire types for client message handlers Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 10/15] ui/vnc: fix out-of-bounds write in lossy refresh dirty marking Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 11/15] ui/vnc: validate SetPixelFormat field ranges Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 12/15] ui/vnc: remove redundant rows computation Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 13/15] ui/vnc: Fix crash when specifying [vnc] without id in the config file Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 14/15] ui/vnc: Fix qemu abort when query vnc info Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 15/15] ui/spice: fix crash when disabling GL scanout on Andrey Drobyshev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904101206.701978-1-andrey.drobyshev@virtuozzo.com \
--to=andrey.drobyshev@virtuozzo.com \
--cc=den@openvz.org \
--cc=svt-core@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.