From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from PA4PR04CU001.outbound.protection.outlook.com (mail-francecentralazon11023106.outbound.protection.outlook.com [40.107.162.106]) by lore.virtuozzo.com (Postfix) with ESMTPS id 28E2F803D6 for ; Fri, 4 Sep 2026 10:12:28 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=nbnQ1aMEBjFtdwk3pYqwUNxle2C8aCPONOX5WOYV+8m4PDx+TBiURhrgEdXIy6xr5HserdIpI570hEQOkYl3FYTBq/BQFkBVUZciWwxDznF61Y4FOiRIFPyw/HyFsfqGtQHg+qYtxJJTtHhIZWPnaO5l0/bZbXDtsPRhSP7copxsCKK3Wd0hBITwtdl3L97zR55sWmLjKxJq0LC2BZv/kir++DVvAEYhCMjrcxZhQsNXraufADFgDmYsmpbqBJnYPKcabDImnmA4WAzsnPkq2dwdtXF+Vk/bOjG21w5QVNinIZgUxmRTr79VcBEAbl6nkksrkzI0p2I7Zj5mjFu/+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NHyu4O3dYB6m6l6bucZUKwmpzycM1l1GQz3u9tL6BRA=; b=Cp/sFGvqDaag/+TUMwuB1mgEbCSFB7pQU26AwGGu4cRrZcrwn7ghMFDLt24W5KQ8niyUGmh9k7ij5J7cdJzbconh9RxinVh67n/CqfSwFaaY4QLjAqq9OL7khSA3TlIbdAdIeE3OqPpOvUI0iU7sckveN+WeVr6RpB7c5sYr20R7JIk3E6r2PtCGutb9SwZrumuH4CSHDZV1IIIzsAY3mnt1oovpoOeMYCXfAnFUSJGs/ck27UAKdPWSHOSK4ENX2fEZJJ+aMILPIuofZR8FjAMhINL5TeaKSyzf1mTA4xpjiSdpANFVdtirke1Yp66dJwQNf3P0bfZ7FlP5m5yhZA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NHyu4O3dYB6m6l6bucZUKwmpzycM1l1GQz3u9tL6BRA=; b=m3imNXUMVkI9hnpuDR9GOBZ5xD3z3cuIVOw2ysZTGQFQTec8UNz8oJYLSuient1b/ZVth65+pNa8ATvqN5fUGRY+51jFIDq4VcbGrCG9lqidwzEbX9cLocyc9u+v17NSNC5Jy6UlHce1LGjyU8uh50LBhnhFUOTMC3CT5+BsmB2ehSXkmWhFPXsHMhaM54l4vImDvjJHpkallzlxhdszktHXAgAZzHOh+mJbOi09PJFf4xKMBKnhoe4U9U7IUNQ0tM4eXGA4qrGXbnVFhh8eDelUqFTYaKgD6w5r98DmsndNJKCzcfzUEfUhiRmrLPx4NH7WivmBsamZ9MRKrLJdtg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:24 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:24 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 10/15] ui/vnc: fix out-of-bounds write in lossy refresh dirty marking Date: Fri, 4 Sep 2026 13:12:00 +0300 Message-ID: <20260904101206.701978-11-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: f7d76e9c-617b-45c6-acf9-08df0a6d022c X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: QT4PJ/9wehpLlUJY2GS92NbDjZtRiZVJnYfk3fJDx5AtnTG4XD4w8y4VxunzjT2YuEnMfGvgRIB8Xf0IUro97bV5vFLZjZ6SWLwlU9QxikSGdjKeRJwVIwRaXPB+BpdsTiwMOb3kcYyzeXRM7Ot8+bpN56vORhAW+cwypcd+dZqv35VOqIspWw+5OHLoPFBEJ1yfTbSsdwcPcmU+U849IsrIS25GE7PC1K4P+EzS6gHJuvS1gs4xPu+nlyi2uX0XfGGF4nbRgMViKJRJON7muoVnoQ9pSH1W1GmD/WQFk5IVd4aagCrvbGyZaEKBy6HEJfdeiXXO1qZI6cqgZP906D+29KLWgTCMVilp4St3WPl4V8nbst1C+cJ5pXdNhMpWJCXL/vKtkc7/Xrfl5Ck8G9LOzjOY4azmJTq5P5y4TMjYIwcmwMkPLn/mS1pSjFC7vC6NMrCPthup0GFODQl0Eorc5azVBGhVjJffvMOn62lMhkOeny4Q/jtdjmIyK2EPbLZ5wpwmPllwnJSKXi8x5Juz4sed4NQu731NDElQwLYQPS/qqtPoOVWdCoSrGwAxdKsrMMORrzT2/+b/OvWV2Z4wnMhK+GxJ/V42g/7Zp7dzQx+Hzj8VtPjWRKYhNH6FRLSN6QOvS5aGKPD04mfv/JFc2Ck8QZ7SFWD455+SLseTAYvRMJQFYKyrwFY+QBAPxXY/HelYvtdG1R8yRDTbeLF2cFM1K3hYhSwlIrx42tY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?aHlodnd3UHhSMGwvNXVpQ0xUTzZGekFYYWFML3k3bHYzQjFpYldVdjJBZVFa?= =?utf-8?B?RXZFNk1hbzhnN3YzSUhTZTE4M3BWaTlSRzZtOHp4dW1QNVhlZ0pPYjc5elR1?= =?utf-8?B?bDF2b1RsWExOckJZai9nN3hWa0ZFeUp2KzF2OWRzUUE4bm45NElCRy9qVnhC?= =?utf-8?B?VjNHdlNwQjBJeSt5ankzejRIZmdrcmNuZGVPVUJDekh0Rlpuc3NNazBYL0lJ?= =?utf-8?B?Y2F5NUhLR2ZVV09RUWl4UmxiR2pvU2h6UzhCMUVZV0NCMDg4dW52SEpFQnNz?= =?utf-8?B?TDdrSEFjOFdsMWxLc2pMU29KWEV4ajlWMWphdjJ1cURvS1V6RnJQOVJyZzhO?= =?utf-8?B?UTFZbUZJTzVNMEVCek8xOXJla3hpQmZUYjFNbHY2MlJ4L3lUU1l6L0dEYjFU?= =?utf-8?B?VE5BRExzaXQ2VDUyanlkRTZNTktPa2FrckpuOHN6TnNtQnpIanJaM3BLN1hr?= =?utf-8?B?bFQzYXlsZ2NpODZRbEpxbDJEa21pWVZRaDVqQlVnVCtmbnAwUXlGVmR2UTlG?= =?utf-8?B?ZXkrUzAwRUNJZE1Rd0UxTjlnQjNRQzdQSjBCdm52OVBPcStnTTZxK1RodlAw?= =?utf-8?B?TUxnV1pucUtSRmZkWXhEekhEWmk0QmJ2blF4N0dYTy91UGpuT2ZaaERtVTRv?= =?utf-8?B?ZldvdDZPTzFaNkdBSGZHZ1JHdHJYT1RjdVlMN01kSHl1SFd1eEFlMnAzVDdH?= =?utf-8?B?WktvazNaK2I2eFhOMEpsWDlnbFhsQmtzVmJVcFREbTdHd3ZIVFRuUnp3MzFq?= =?utf-8?B?OTdnRDFHRlNjQWdiZFZMdWNIMkVnRi9nNXErajQyRmlqUnRwQ3NxMUxBemVB?= =?utf-8?B?eWJZckUrRFN3M2ZsTnN5UW1Ld3lINlo5UHNWemFSZFJ6QXJteWU2K3BuL1M0?= =?utf-8?B?SmFqa0ZYdHJPdHNlUmJVSi8zWTA0QzJ6OTkwVmV4ZkU1RmJ5VEF3MFlDWnlV?= =?utf-8?B?clU4RzdRa0FBZG03a2tTN29NK2pBaTJlTC9ENjNMMzFRakdmT0ZBZmloYkdM?= =?utf-8?B?emdOdGlhSEdUWGl0Kzdhdm1BdFFvK01uWFVzZHZDMGV6cWkzalVEOTQ2N0RU?= =?utf-8?B?a1lnVUZrWnBSa1lER1RkNUFjMW51TElzWENjWDBqc3RNNUdneWlITkpFU3M3?= =?utf-8?B?bXRqcTk4KzhBbzhHb00rM1JOYmpxaTRmdnlwK2tNbGlJWEh0K2QvZ005SzdT?= =?utf-8?B?cnBqajdSbkJFVHNLZXVwK25iSXhaU2FWczZMYUQvdmw2MHNXblZ6Vms0d0FZ?= =?utf-8?B?TU4vRC9nZmlnVEFhcUpET1ZlNWl3TVJHRlBmVmo1S0hVRHY2aWxTVWR0TkZz?= =?utf-8?B?b3o5cGIzTCtWaGY5UmVhaWt1RVhyRnBGRWxnZUx1SWFSczVWNnBMOHlQUUIw?= =?utf-8?B?VzhOaGJGYlpMbEYySXJnandxVzZLOGN0WEJFNjl1RWxyMnNZNFUrVEN5d2Rp?= =?utf-8?B?THFYV2FYbElzTk9zaEVhbElQeFBvNGZUZFByTXcvQllPMHRHbGl3YTA5MlBR?= =?utf-8?B?SWdVa1A2SURwV1RSNENYUmQxU2xlWlR6ZExzU3gzVVg0Sy91aFRwWVY5MTY2?= =?utf-8?B?TnpNeHA0c2psQzBUOUpuUWs1ejduTG1ZZmFwcWp3T0NueEdETEpicTBjNHd1?= =?utf-8?B?eW9tU0lKRHJ1akwzRGtzZ1BHVk1uci95NGhsZmo4NENGdmhyRnNyai83b1hi?= =?utf-8?B?d3VlWGExSFFtdnRLd084aWY0SUhraVlENFFXZVpZZGpaTjREWjdnWEdQZ0Zr?= =?utf-8?B?d1p2UEZQR1RmSEoxNE16c0Q3amw3NXdWdWdNUnZVWmNaRElaRzNqc1EyY09X?= =?utf-8?B?NlR1NHU5cHBibEw2SUM5ZUNROWpUU3hFR3ZMNGpGT0JIQ1BiTkl1dUs5dE5C?= =?utf-8?B?NjIwS2FYYitXTXBWZWQyL01WWlhQV2lSRU1zby9WVUFubnFYeHZGWUdGdjF0?= =?utf-8?B?Q0xYbWgrQnBYTUUrWjdncVppVHpIOUFqNWg4bnlxZ21ReHlCeTBRd0JRaFg0?= =?utf-8?B?UDJ6MXU5Sk9QcVpLRGhlVXhBS0o3eTZMQkdpanJSbjdCYVJCbzJLakp6TEF2?= =?utf-8?B?SEh4RDRvMDlUU3R0NThvRGloYWFrcWNQdytCY3JtVXRZaTdoV29sOUw5cml3?= =?utf-8?B?WnA4M3VDa2I3RUJjcWRmdGtWZVFMdDZnc3hKUXNqK0FUNml4eFhGbVY0UUZI?= =?utf-8?B?RGM2ek5uT3ZjeWNXMjZXaHV1Q2N5eGJvZ1UwRDJIMmUzT1lZekhpY1BkTWhK?= =?utf-8?B?cktTYUxhTXVpNDcveE0rNDlpQzBuck5OK0ovR0NzQWpwMko3YUVvNmtNT1FH?= =?utf-8?B?c0hVNGoyM1dhUXE2RElPa0NlcHBSNkIzNjl6ZERhSHlCdEczSkE3Q3E2cjd4?= =?utf-8?Q?yfFolXGYUUu1/5nM=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: f7d76e9c-617b-45c6-acf9-08df0a6d022c X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:21.6770 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: xo2pMqQG6JSN3L4Za4rBrIZ5IM4tDwyqba/4oPWTRB/SQ2addH/Ezjp6Kxgr7uoOh7t9/+HDKoYP738KwXbcpfwadW7HNdeQCHppKxx2p+8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Marc-André Lureau vnc_refresh_lossy_rect() marks a full VNC_STAT_RECT (64) rows of the dirty bitmap when refreshing a lossy tile. When the display height is not a multiple of VNC_STAT_RECT, the last tile row is a partial tile and the loop writes past the end of vs->dirty[VNC_MAX_HEIGHT]. For example, with a 2160-pixel-high display (VNC_MAX_HEIGHT), the last stat tile starts at y=2112. The unconditional 64-row loop writes rows 2112..2175, overflowing 16 rows (640 bytes) past the dirty bitmap into subsequent VncState fields. Fix by passing the effective display height into vnc_refresh_lossy_rect() and clamping the inner loop. Fixes: CVE-2026-61475 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3935 Reported-by: "Vulnerability Report" Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Marc-Andre Lureau (cherry picked from commit e650e4fe0fb35b7a8ec9fc04e00346c02640bd58) --- ui/vnc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index d76a777cc94..40b4e7077da 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -3021,18 +3021,18 @@ void vnc_sent_lossy_rect(VncWorker *worker, int x, int y, int w, int h) } } -static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) +static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y, + int height) { VncState *vs; int sty = y / VNC_STAT_RECT; int stx = x / VNC_STAT_RECT; int has_dirty = 0; - int height = MIN(pixman_image_get_height(vd->guest.fb), - pixman_image_get_height(vd->server)); int rows; y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); + rows = MIN(VNC_STAT_RECT, height - y); rows = MIN(VNC_STAT_RECT, height - y); if (rows <= 0) { @@ -3104,7 +3104,7 @@ static int vnc_update_stats(VncDisplay *vd, struct timeval * tv) if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) { rect->freq = 0; - has_dirty += vnc_refresh_lossy_rect(vd, x, y); + has_dirty += vnc_refresh_lossy_rect(vd, x, y, height); memset(rect->times, 0, sizeof (rect->times)); continue ; } -- 2.47.1