From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazon11021116.outbound.protection.outlook.com [40.107.130.116]) by lore.virtuozzo.com (Postfix) with ESMTPS id 2CE8F80275 for ; Fri, 4 Sep 2026 10:12:24 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Bgy4saYwbY+tduK7u8/q8L/H5YRHKuP+zBV+QFp0aum7tOfLZdauOdKxvuSaAO0PScLpv1//ekF6+fggbPFHtBcXqlpLIDVQjSCZhAlgZjU6zY6oewBWbfSNFTQ3MBjwCdM7btmuF8VDzRcHus9FUMkujb9rCi6rhJVmjvCMUfUNsVr/kArgbqHyDYZktcbpztUWN5c63GEsEjSfEfwVlqNkIWsiw2BTR42vTWFPoj3Lv4y1POgRxlb7AiBkjbR2Pf7TbOLg+sUcpZnmWQ4pKSoQUX1WBOUbj+6iPAXDtA59k789WW2VP60JJIWIzxnaMf7t3tbRvB7IyNvo+2E2Cw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cp8Y9U8o6JLh1W4sLLq9L11B8NDEnPyoDg1ws6+On4Q=; b=D/d8EYoh5+4UXq7IxLDedKOJ9lzdzNDS7u1OkF+EK1J90DFxggIDplNlW3VK0g9PMJI/8PW8c4jLbQxk+WoxB/DSbRcxFhxm2yqeIhyk/T5TDruo1BduLcIrN0Xy9EyeaKwDO6htSl+oBmY7B0wNzCi1Sn7eqPZu+YaK6K953xDQ3mE9amvag3WGxXaVoZOvMQJeStuouWLAaokJeSSq8uoSnJgUdC1qAx7hY9LiWXsHsS4Cbpnkt2CdJfP1Tyug/l+TIq/ACny87eIoL1AS+HLFACiW1G47z6hn79MjyjQkywGqIcv4k80nzC1dHnRqFabWHS9GEDI7wsANrbTqNg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cp8Y9U8o6JLh1W4sLLq9L11B8NDEnPyoDg1ws6+On4Q=; b=gCPpTa1+WH0Ge+T622BRLgc0B8n5ubCixqZKBO9JEgI8cMJ4bBfaqBxMuaI2dtaz8SyZune+BmjPpLeE+YdgYk4fp8B8PyYWVdPxP+XVWidEjzso7HjtJ2124vg/4laI11o60jMzXyNsY/oLvQena8oww5whAD/hSMRwQkuy2xP9J0XJUG8UwE5+iGbfuKHow5pCvXWwqkoxOe5YfCFW6m1hROxr7r7gVMnu+NdwhJGT2ElnXn80QXLEbs1YiAenofP16C33ctxgPEq+Aw0PEmyuu2PCxZBRJ7/FDAFuZ3kmz/lwoziLY2ZAmMk2twqeBi/h+bkf7Paza6QT53DjKg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:23 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:22 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 06/15] ui: fix validation of VNC extended clipboard data length Date: Fri, 4 Sep 2026 13:11:56 +0300 Message-ID: <20260904101206.701978-7-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: 7dd1893a-a798-433e-9e82-08df0a6d0129 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: nOIfNGk3rRB8tws0BTuVDxcfMCo2ZhXD2+IvGfO1d3eUrT8appDdyB+syK/BuO/Cm6YGNBgLl3vucYTW/zWe+WJ8mO1aoLoAm9WrIXxr/HdgKZNgBNgqIE/BZe6K7P4lEZqLtPZNA4QPmKCdknWemQ47wP+TbpQ7sPdF4BvpHUTtwtq2VHsJB35WfPEnfJ/04DLj0cCvygzgFwp3lfhO9QxmuZ2vnwyY16MYQbyJVpA0h9BxQ4h4la1HjD3CSXmibCaLOWwSEg1FqDz6ITjPLbi2zkAsHyoJWlCdMUyWnJBixouJ7Km9dJk2nO2WQKEt/eMRD4xVNN1WvR8ZZuRkd49HCd75JcVjhVeFuGPMCo5VQxtRfRttCEAZU+0dge2aFOIPt+FXmT02xzLguj433cTBtNiw0IJDX2S/tWM+1KyPfFoA6vuP/voJltIDUGdjkk9y/W6CgUKJgOl+XlmMTdJi60QdioS++Tj5063k3ePolqAJIzrj8jZVS/vjUUjztUdV1nRlpAX56QGhVbew9u+DHBDCo5CRViJPAoobEX4V0zeGj6h6DLFmG0jwiIMhsjTu7JWhgCohnTH44UelhP0dZPhq2S+1oxQMg9cGqgx4VANTG/5xL5foCRr5sYI2r+8x2kq+EwbF90PUuSHe8Uz2vaoVe1vCmlkLsTGUHH+ACbsDdJUJe4MFbAiVXtfNDuoxcFkU9c/maws5wnWk0UrqE9QMCYVZ4YYJDvFjX2I= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?SnZiSHYrL2oyNjdEOWtYd2JxSHZuY243UVh3SC9UUmhBd1pLZ3JOaGtKdUc0?= =?utf-8?B?TUhRSXFwcTQ5cTRTbVNNalA0U1F6enBCYkgyc050blhkdWEzaVFDeXowcTA4?= =?utf-8?B?akpHRTk1dkZRUFFVQ0tlUkYzV3JhMU9kU0xlMm5IdnpDemVjbHpBZVdXdFNs?= =?utf-8?B?ZHc4QzFTRzlaNUZuamZoUGp1L1k1NnRFcmV3RXBSRW1qRlV0TkV2Q2Y5aTNB?= =?utf-8?B?Qkh3MUVjTnZneWlDeXZzdGZnZXNkL3l6R05iVWJJdXc2YWpOR2lOdXdscExX?= =?utf-8?B?QVlmOGdCT3V2R3p5ekZ0SEtGNUpqZ2F1U0gyM3MwdVJnNmVOdXlpZjR3OU90?= =?utf-8?B?RElXb1pHUTNkMUxMK2trSjJIcXJWQ2wyVW5NUUpNU0FDZzBmZUV5bHBkem5J?= =?utf-8?B?eUM3VndCNmJvMVN2ZGFxT3duUWJhSktiZExxbGd6akJ0cStPZllwYXVSNjN4?= =?utf-8?B?aTE4SEpaeU5Zek16dUdyeGJrSUFJRjJ1bkRZSFpqVm5YOGFkRXFpMlcza2VW?= =?utf-8?B?ZHNUb29laDd0WXpFaFhHLzhUY0ZYNmg5QVlhSTNhczdSYnBpcnhiQjJac3ds?= =?utf-8?B?cUQ5VzlkdkZLcGRtMFdPek5UenhXVGpmbmtveVl3ejFCaDBuTGtUemtHOGdm?= =?utf-8?B?VUZkNzh2eTViQ2dmdVE3bDFpVUF0WllFUVJ3UlV5UzZqSGkwZzJ0bG51bnEx?= =?utf-8?B?YWM3dXhORlltR0hPQVllSHgrVFRaY01sNXhZT3NBbTluWTJKWmxwZlNRMmph?= =?utf-8?B?RWVjUWxtNTJGczdJTU13R3c0NUhZNnJEUU5scVVJVDdYc1VvSWErUVROWGxY?= =?utf-8?B?NGtRS2lrN0dka2xoNzNMTVVlTmlINVkxV3YyY1hSTzUwSkgybU5iaHBlNkJw?= =?utf-8?B?OUErKzBvV1lackJ6ZXB4ZlBPVXlETFNqZ2laNFhzeWxXU3NFZkZIN0Q5eTU5?= =?utf-8?B?QmVlNDl2ZnI3U1k4S29ORWR1dkVMaXFYMW5uaGlWYmNWUWJHWnIyODRvWWNz?= =?utf-8?B?aU40N015NWZCc0Q1UnFYdnpmZmxUbW5MZ0s5c2RsNXM2b2sxK1lWaGJBQmdQ?= =?utf-8?B?ejUwQnZFU29GZ2xpNkYrME11QURibk84YjMwODdMdVRBNnFjWGs2ak1BQXZq?= =?utf-8?B?TGJkdmZKOG9qdVJtK3pUUXNLUXVEbXFLTUZjR0swekJGK2pHRTltVnNtdG9j?= =?utf-8?B?WEFkaUxnU1d3dVR4OC9qWGcxVHlTVEFycDBKS2RPZnhlT25yOFgzVEhRSXRD?= =?utf-8?B?bGkxbndIUHpneDhWcFJUVUhUU1N5MUkyNFd6bnBCejdUQ3owZDVJQzQrNklo?= =?utf-8?B?REJIRGhkRVordmJMSml3UUUzN3l1Y3BEQklLc0I0NmNNNDdoUDRjWEVYZWJV?= =?utf-8?B?RTB0SnhOa2ZGRmY4Ym1kM2NuL05nUHBJYXhtSGUyZS9sRUZOam04U01ZanhK?= =?utf-8?B?bThJYWpMczZ3NXFFTmEzWW42Y0NTZ1hHTkxRV3pJS3hGeGkxc2hnYzJKWUlG?= =?utf-8?B?RFhwQUdkanB0UkN6M0R0SE5LVHNwYWtXK3FRK2kvcHpuNTM1VjBKMUQwdzdK?= =?utf-8?B?a09iaitaem9VTU4yTlYzRnNwbmJ1U1pmakR1MGJxMUhQM3Yzdyt4ZGVLcVNI?= =?utf-8?B?eDluZUd4eHA4QWdlSFNPaXlzN1JocTJhejJiTzd0R04xekNzdG9nZVRRUDlP?= =?utf-8?B?MUZwZEhYZHhYUDVOYXNBeFlZSWFpSnU2dEtrcVBRTHp0U3BvN0FtTnp4eDZ1?= =?utf-8?B?eEREU1RTSk1LS3pmVTdOVDZDRWx1NFBEamxNSzlnRmYyUWloNmpWOUFhY0xt?= =?utf-8?B?bEY0V0JvdW1iMTR4UnE4Wk1SSnpjSGk0d2h4MzVRamhzWFByOG5ZeXIwa0Jw?= =?utf-8?B?VXd6UXlhNFdEYzJFK1BHVWlXTXJudVZ1SnFQZTNrRmJaV1hDUFlXZ2VkTUhX?= =?utf-8?B?NWxqWHYyVjBXMmFUVm01M0FRNUVvZWhpaGVWZm42S2N6V0JiUEZCRGNiODBT?= =?utf-8?B?VmkzNDVuaXdoT0IvZVhRQS92a3R6YlZjc3RMZ2xUVk1CMXpRN3dwc3dKWFVh?= =?utf-8?B?M1F6V3pPNlkxRDRJQThRMk4yemx5UmJwTk9uano1MXRvRVFwZWd4RUJkRjBK?= =?utf-8?B?dHJPR0t6dmpES1Ewd1RGTThKSm80MTZubVN3Y2wzR3c5dkpQYVI4YjhrVncw?= =?utf-8?B?MW14eWdjenBZS0JLRUxWMWRkUHJMNW5zT0t1QUMyeG9GU1VWcTlpSFIybk9Y?= =?utf-8?B?U2tHZjhMdlV3R3NNTG9ORkt5TVNsazQzL0U2eFZXV1dlR1h3QWp0L0hFeW1C?= =?utf-8?B?S2I1NEFFbkZ4YlZmMkZmR0ZpWUZSWUNWcW5kcGtOREFCWjRkNHY1dFdHR243?= =?utf-8?Q?0H/1GjFKlvd+SCmQ=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7dd1893a-a798-433e-9e82-08df0a6d0129 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:19.8745 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: C3FQK+wri+8DuGHbH3mvmiYAZV26kkOPI4mPgQLBUy5gjteIoZzoq6SwJ12QqqK0EvmIYIsnjMaTws3ubUY8Y8HO9+CO+4rXH1HkHl/HI8o= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Heechan Kang QEMU's VNC extended clipboard handler inflates a client-controlled compressed clipboard payload. The code checks the declared text size against the total inflated buffer size: if (tsize < size) but then copies from: tbuf = buf + 4; qemu_clipboard_set_data(..., tsize, tbuf, true); The correct bound is the remaining data length after the 4-byte length field, not the total inflated buffer length. As a result, a VNC client can make QEMU copy up to 3 bytes past the end of the inflated heap buffer. With a second VNC client, those copied bytes are observable through the normal VNC extended clipboard PROVIDE path. Fixes: CVE-2026-8343 Reported-by: Heechan Kang Reported-by: Feifan Qian Reviewed-by: Daniel P. Berrangé Signed-off-by: Heechan Kang [DB: added #include and 'return' statements] Signed-off-by: Daniel P. Berrangé Reviewed-by: Marc-André Lureau Message-ID: <20260512095543.459949-1-berrange@redhat.com> (cherry picked from commit e56b4bbff1df260487b80abe1f967f687fa115d3) Signed-off-by: Michael Tokarev (cherry picked from commit 5501ddefdd6ed544436b5c8a6ecb04ad8673656f) --- ui/vnc-clipboard.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c index 124b6fbd9c2..fa05d86f424 100644 --- a/ui/vnc-clipboard.c +++ b/ui/vnc-clipboard.c @@ -23,6 +23,7 @@ */ #include "qemu/osdep.h" +#include "qemu/error-report.h" #include "vnc.h" #include "vnc-jobs.h" @@ -282,10 +283,16 @@ void vnc_client_cut_text_ext(VncState *vs, int32_t len, uint32_t flags, uint8_t buf && size >= 4) { uint32_t tsize = read_u32(buf, 0); uint8_t *tbuf = buf + 4; - if (tsize < size) { + if (tsize <= size - 4) { qemu_clipboard_set_data(&vs->cbpeer, vs->cbinfo, QEMU_CLIPBOARD_TYPE_TEXT, tsize, tbuf, true); + } else { + error_report("vnc: malformed extended clipboard payload " + "with text length %u exceeding available %u", + tsize, size - 4); + vnc_client_error(vs); + return; } } } -- 2.47.1