From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from PA4PR04CU001.outbound.protection.outlook.com (mail-francecentralazon11023106.outbound.protection.outlook.com [40.107.162.106]) by lore.virtuozzo.com (Postfix) with ESMTPS id 567C5804D4 for ; Fri, 4 Sep 2026 10:12:28 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SBw66BcxNQfIjNt9pvcy6sOjuv8xcO4IcuT9+EVbfXvfSA7XLE5ZXjyoj7IH0gsOQYsv8/YjYZGznqi/2vp6jhYqUQ43QieGDl9Kk8k8z/0tQAqCvJbS7h7gQMX6v/KK38Iq+Qa7Le1ONVEioAHaWxfYD7HJKNMPbDkWGkm7q21j4IUZNAmEmd8II41k9pd8qTKoaMCrouIHZYz3wi9mjOvyAQnNMQVqoN/uoXKoYDUOgEylU6uft3snm6EmhB+3s6xuoT1zgYt9OvMScsAKKxy4vqNBOKvU0tVdm/6tmhlPU7OfLnFTZ6358OuP3yl9JeeT6zUzWhmQ5VW1fZ0Pfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=aPxk3A+99GXCbmtcEg6VoqLJISfceCV5dOJPbFOE1Zo=; b=KNK6rQwOyTzH7ky3eXU88AarrRn1mBhs7Io5nwi61vxxfR6/ui0d3TIGLhnFo+1y+PZG91k8l7hB8thYv0vZrhUbmzU5AFSDgQla5dBfGFA7h17l0xWXXoTLSXkg4MMeKgABYkK++EQOGlG0CJ0i5Dtf5Td/y+xruCEdjrx2/MLLwwofqPoTIvf+0GFduw4BOnWm1E6SPZH2xAgs77+Nm7WYP0QkaIN4zTHlulz0jNQe0mBIwCS65fwFZsyGJZa53DnbYgPvmIOIo46WWPFKqj3TYqqm3RLlLwe9T//wyWHj49QeqhVVPa3Exhs6hfDRpfp0PbjOJmpw7zvqmG/YTA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aPxk3A+99GXCbmtcEg6VoqLJISfceCV5dOJPbFOE1Zo=; b=fVr2ZLYlQnKb+Nde/tSD32w0ShzKUwUHf1xK8IjMJmVTpQVDLDQdFEvVaH6cIXcO2KtNZYTZp7aJV6Bvu0O8dgy2lDjLooz/YwqAarioOSPoU34Mgl1tv4VB5lkNg3CEFf0Gpz7f/IzENSNCgfQT2NrX+UBCQuRWRwvsfexi8wUJ503EkFR+VL8FaU0gk8mXHDKLj5ghtwyrKTfv2JmQ4+OfJkxyuD4RCpDtYkFTiwiCzg7bFrW484L4bKNyVcOvo9C65lNZCbbr0996iS7kz2n7qOboAqENbPvPCqOXX/ezuY4+JG3d0t7XBkBkVmUetoOjk7YEaJrEdAI+RR7gcg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:25 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:25 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 11/15] ui/vnc: validate SetPixelFormat field ranges Date: Fri, 4 Sep 2026 13:12:01 +0300 Message-ID: <20260904101206.701978-12-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: 4b683a93-0cd7-4eb5-a07e-08df0a6d02a1 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: k7g9+bQOGN0jWlSvyuedLF3On/vs+k8VcsV/aNALU6Bet/x1RC9ZfsfAHk9G/Lpf5FBox5lYH09zLfrS2kxYEl2qsrRDsxgwFDcZuToActujYf6YTVSHuqS+wrt4qK/KrNv+kAloAqffDpuuH7ZwzhlRVFOetZaPHHzGBGRY1MCOWdj1XgmU5M6ZnNzYBB3wg5x8ZquPOw5BrI+gVgF1SVDR5tpY+L1W0f0cGwKRyarL8hFAC95mE0YWNTpjrYrEBbWSg75RX3Qjmq8sQpUV8qDPAtTQWZHbazrBPTj3JrzQKS2k451Sy+kpKG1wdpZLm8vUZ3n6+ZzmICipahnUpqv5MZoYPzhEGlTtTjTiAs522r3UYrIezeTRTPkbBKyr4OuG0gHD/zmDYpgRlAF1bE5euq1t/E8edL6/vBv274zaddTE7R3sBHC3LK+QyhKJz/ZtpVPVORHZ5r6eM9QFmucxieG+MgzPhSuuf6FVhRDxh3iB8Hpr+OrxzBmJXXz4n2pXi+pcqOSVKWfKCa1T5WmPEnH8R5QvJcCjKNV1NSU/WEhUhqWSFL/7Fz4KaIjPc2+7GnEA/Q3LwyWkx1W8aRN08+Yy3TohTsDBQhaQkqErdOV1HF2ksjRng2gG0t4Y9FzZzp2ZfGtUDMreHkTIXgVYdF/080REiYdldDnljHD/aowM8WSc0nWCMpTzoSlLbeGIkvVen1rmiCn/xqQzDxEIlI1xsaAMA/htBohvftM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?UXNUK09LWG8xMk5MckwzUlFxTHVXQmVxdHkrbGNCd3d0SHJpRzlLRlJuL2Uw?= =?utf-8?B?SzRjbkF6MlErSXBJaERRWXZvSGxzbkU5VlJyTXRXbUh4djhYWVN0RllybjdN?= =?utf-8?B?dkdzYjdwMkRMd29tQnlEUTNPT2l0VGRpTi9kM2RPWXRzWmtiYzVkNSsyaERU?= =?utf-8?B?MFZ5dWlPUzh3R09KYmY4ZWRrVnBudENVeERSbUFnWHErYS8rR28xdSt6L0Rj?= =?utf-8?B?QnBWb3p0N25jK2VhTkFNc0w4eVpIMis3WDhuWnA0NDRYcDE5aWNCemFFRDlC?= =?utf-8?B?d2FmWmtTOWw4M0drVElTcEFBN2dyMmduUTZiYkR5eXFaa3dwZHlaUlFiZ0lm?= =?utf-8?B?d2lUWDU5WHROM2RCZDVOU25sMVBuc253UWdwVGU5ZUVrekoyNUhYNnFJYWQ0?= =?utf-8?B?T3dtSW9QL3FjdFIzMXJCaThqKzl3QlVkU1VYZTc5UWMxSGl3aVpFWWoxaVhr?= =?utf-8?B?NjlQWmRLQlkxa1BKZGQrM1UxN0RGYmd1TDIrdnRHQThuOThXcitMK2tpSGR2?= =?utf-8?B?bzFsdkNWWlFuOTJGR1ZzNlJrd0hjVnFaaTVuUUhneEI2a044cVl5Y21oRHFw?= =?utf-8?B?UWVzSmRHVlRySTIvL0VZc2ppOGVDb0UyOExnT2tTZC9mNmlHeXN1S2NVMUNp?= =?utf-8?B?VXhvZ1B5QlkxTU1kSkUzUVNXV1dhbkNpZlpSY1pCVnFoazNxRWg3NVNJOU40?= =?utf-8?B?OWtnUG9DbzNxREdFaTlpMzBUck5idXEzUHl5QThOWVl1TzJPVVgyeThINTMy?= =?utf-8?B?R2dyMkEydEVRWWVVUTRxbFBDODJkREppRWRRa0tHQm5VdDNrSVhRa2daZERh?= =?utf-8?B?U2EwVHpwYUEyalJ6QmdkVExxSDFHRWhSVExQSGNDcUFjWU1qWTh1VTNoRlNy?= =?utf-8?B?QVVyelp6VTlaQ0JPb3YzeG9aY3RSb0p3ZjVaK2lNTEhncWVqV0F1OGtyakZs?= =?utf-8?B?bHVWN0dEbHFtdzE3bEE4OTA1SXVEemxZc0NwUC9Dd0FWTGplRnAzNE5nRnRa?= =?utf-8?B?WmJONnBlTkxuWVFPY0tTTGVDeDJLalVZV3ZVT0hyVkJRNm1Lc21CV0FkZG9q?= =?utf-8?B?cS9oYklsdVRib0NPTktmSTZzbEUxdGxSQTJpNFNCN2xhN2JKMkdpVWRMYS9h?= =?utf-8?B?cGJCTUJBWVgyS0hXOE5ob3ZySXZVZFZ2Z3NDQmpPT2NZYWsrRkdGMzFDZlI4?= =?utf-8?B?S0M1RWVvQ1B1UkdHMVdmQm1sR0ZPalFsR2NJRXdTOVZKZ0RHcHZzVXNCYVNY?= =?utf-8?B?dkU5NG8wT1IramE3RStkaGpxcms5aExnUGowc0NXeVhRTmcxUzB3UU5LQ1Vv?= =?utf-8?B?QUV3Wm40b1NNc2NEL1Yxeis1bjAwYWJWampEd1hsK1REb21nRDkvZ0k0a0Yv?= =?utf-8?B?U3ptU3Z5eUJJdVd3Mk5XYjQzaVVXYUhBSVp0ZFdCZUoyOEdyU0Qrd2p5cktI?= =?utf-8?B?MG9zVjNSbXBvWElaWGNWa1BIeEdNU2NPR0VTSzJrMld4ZGZKNWlDUlU4Rk41?= =?utf-8?B?djdQYmxYQXUwVjRLR1lvT0ZVYUFLMlBoVWhTa3lvTUUvNkIyaU9TVEdjcUNh?= =?utf-8?B?U3cxYXJFcHQ2S3I4bkxWcXQxYXhvVHVjaGJnMG1BblJ4OVZWRFVBaFRHWjNa?= =?utf-8?B?VnFhV2FhQVZPVU9CRk40VGE5NkxydFdaWDQxRmt4Nys2SlNJbWJPTC91cVM5?= =?utf-8?B?TmRFZDRaL0IzUUJySExLMlNGMlRjcmZjOUxDNGNOejV4Y0VMYlpFWEpQUSsz?= =?utf-8?B?ZEZSZ016c0xFajBqMVBvS1paZ2c2bHdrM25JTU1VbEFwcUpmWEhIQ2RGQW1O?= =?utf-8?B?RjFnelI2eCtpTFpxN1FGeEl6cUtoMTY3ODd5elNoeWE3QkVwWTBRSzd3MWJz?= =?utf-8?B?T3dTSllQMWpQV2h6N3Y1RTlUYk5OZ1BNVHR5U3M5YWZNZ0E4MUI5S2NzMUht?= =?utf-8?B?engvdGVUUm9WYmhCWVRoT0RTckRKVmZMRTZDTWRMWndsT1JmTGFOZlh1YjhY?= =?utf-8?B?QUNvMDJ5YXdxQUE2YVJkZXlOS1l0Q2YwUnRpa3ZzcUZhUFBOcGpBUStCT2xk?= =?utf-8?B?NjNwbEloNkhVaWNKOGltQ1JLRUc4L2VhY0Z5QTdwR01yY1FuT1NsVEFlT2Vy?= =?utf-8?B?QndYNlA3ZkozQmh3Q2VFY2xWTjgxNGpPTS9vVU1HdzE3Z2h3TFhQL054VzlG?= =?utf-8?B?dDMxVkxxOUU0VXFpd3hkTmRya1RoOHFKekZ3YlRKbW5NWVdWNzJUeDYwNFVW?= =?utf-8?B?ZnFhd2liVGtTcjhwR2lScDRYTEN3NkFhaEppYkpUbXpSOWptaThVUlRINlV1?= =?utf-8?B?eUl4eTA2VE8vWnlyOTdYeHFuVGxPOFpXdkx3K2oxK29xZ0RuVk5nMHhsdjln?= =?utf-8?Q?0o1eYFoHHrq6rf1Y=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4b683a93-0cd7-4eb5-a07e-08df0a6d02a1 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:22.3766 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 8BpWfjp/e8tMeb9WmfUlNccO2+E2P/savC4lqqyWUxjn7dZJ2DSBaiZWWyJaTh8UigJW3E7ysDBCERoJtifp60fUVBLK8TTYXpquyUCsIoM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Marc-André Lureau The VNC SetPixelFormat message carries red/green/blue_max as 16-bit values, but PixelFormat stores them as uint8_t. A client sending a max value above 255 (e.g. 0x0100) passes the existing non-zero check but silently truncates to 0 on assignment, leading to a division by zero in the Tight PNG palette path. Add explicit range checks if any channel max exceeds UINT8_MAX. Fixes: CVE-2026-15578 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3976 Reported-by: dong ling Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Daniel P. Berrangé Signed-off-by: Marc-Andre Lureau (cherry picked from commit 6075444c5a72ab531295d92050d95cebea8a8119) --- ui/vnc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ui/vnc.c b/ui/vnc.c index 40b4e7077da..5e06e079e45 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2288,6 +2288,11 @@ static void set_pixel_format(VncState *vs, uint8_t bits_per_pixel, return; } + if (red_max > UINT8_MAX || green_max > UINT8_MAX || blue_max > UINT8_MAX) { + vnc_client_error(vs); + return; + } + if (red_shift >= bits_per_pixel || red_shift >= 32 || green_shift >= bits_per_pixel || green_shift >= 32 || blue_shift >= bits_per_pixel || blue_shift >= 32) { -- 2.47.1