From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from GVXPR08MB7893.eurprd08.prod.outlook.com (2603:10a6:150:1::21) by PAXPR08MB6942.eurprd08.prod.outlook.com with HTTPS; Thu, 3 Sep 2026 20:26:15 +0000 Received: from AS4P190CA0036.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:5d1::7) by GVXPR08MB7893.eurprd08.prod.outlook.com (2603:10a6:150:1::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:26:09 +0000 Received: from AM2PEPF00070CF5.eurprd02.prod.outlook.com (2603:10a6:20b:5d1:cafe::64) by AS4P190CA0036.outlook.office365.com (2603:10a6:20b:5d1::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:26:09 +0000 Authentication-Results: spf=softfail (sender IP is 99.81.216.78) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning openvz.org discourages use of 99.81.216.78 as permitted sender) Received: from nat.eu.perception-point.io (99.81.216.78) by AM2PEPF00070CF5.mail.protection.outlook.com (10.167.242.7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:26:08 +0000 X-PERCEPTION-POINT-VERDICT: CLN X-PERCEPTION-POINT-SPF: X-PERCEPTION-POINT-SPAM: PASS X-PERCEPTION-POINT-SENDER-IP: 2a00:1450:4864:20::42b X-PP-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::42b;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42b.google.com;PTR:mail-wr1-x42b.google.com;CAT:NONE;SFS:(13230040)(2092899012)(82310400026)(43022699015)(12012899012)(6059299003)(3072899012)(13003099007)(19002099009)(10067099003)(5063699009)(22082099003)(57112099003)(16102099003)(55112099003)(18002099003);DIR:INB; Received: from DB6PR07CU003.outbound.protection.outlook.com (mail-db6pr07cu00301.outbound.protection.outlook.com [40.93.64.89]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id 09ot0alp515t81s66qdhnmkvnddcc88p6fbkeu81; Thu, 03 Sep 2026 20:26:05 +0000 (UTC) X-SES-Spam-Verdict: PASS X-SES-Virus-Verdict: PASS Received-SPF: softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.89 as permitted sender) client-ip=40.93.64.89; envelope-from=den@openvz.org; helo=DB6PR07CU003.outbound.protection.outlook.com; Authentication-Results-Original: amazonses.com; spf=softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.89 as permitted sender) client-ip=40.93.64.89; envelope-from=den@openvz.org; helo=DB6PR07CU003.outbound.protection.outlook.com; dkim=pass header.i=@openvz.org; dmarc=pass header.from=openvz.org; X-SES-RECEIPT: AEFBQUFBQUFBQUFHVWRXcjU1aStJNlUyTEFlR2N1N1R0cm1taFlGem9mckluMG0wcWQ3TXJQZzRneWo2ZjZtVmV1SURNZlZ4anJZcllpc1pUWUFTQUJERlNNSFV2R1VCR3phZVNRaWlXeHVtekpZZEZUT3pWbGxrWVZHL2pweUxVTUxySm1STUJIM1FBYzJJeXoyelhqbmpxY1Z0VDBnQkRRT0xnenFsSnQ3bmo3VGlLSU5aYWhUek9adEtYWVBRZjBUVWFMdk9FUzhNa1c4c2FrTWt2SFFZbTdEdTFCdmdlSElxaTRxUzlwd3pyUElxVWV4MEVIbnRXdm9haWF1TFdMdUJCQXJVMFBOSTJyOU5vN0k2Wk9xeDBUTmo2UjIrZXUvOFFQRHBycThDbjZEV1pCd0Naemc9PQ== X-SES-DKIM-SIGNATURE: a=rsa-sha256; q=dns/txt; b=UPBJL8IE4Da6nwiNnCK9yGYMXTvrsq1QC8pmSsZXqauiY4750Ofzx6l+FlmQJ3fGJfscRKfh7uk+zuc1fBttCOrY7Ob0bCjpAUz1Rq5ZGZwTkHOGdNC3MCICzqd4YQcC5dC0h70nk2j0+DXa2tI6gyWPbu0etWq526st2WR5kS4=; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1788467166; v=1; bh=K+3QS73wBSS/f9EC7WsyvGMYK331uds1oJ/DNMQDdoY=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT; Received: from DUZPR01CA0090.eurprd01.prod.exchangelabs.com (2603:10a6:10:46a::8) by GV1PR08MB10719.eurprd08.prod.outlook.com (2603:10a6:150:16f::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:25:57 +0000 Received: from DB1PEPF000509FD.eurprd03.prod.outlook.com (2603:10a6:10:46a:cafe::7a) by DUZPR01CA0090.outlook.office365.com (2603:10a6:10:46a::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:25:57 +0000 Authentication-Results-Original: spf=pass (sender IP is 2a00:1450:4864:20::42b) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::42b as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::42b; helo=mail-wr1-x42b.google.com; pr=C Received: from mail-wr1-x42b.google.com (2a00:1450:4864:20::42b) by DB1PEPF000509FD.mail.protection.outlook.com (2603:10a6:18:3::6d7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:25:55 +0000 Received: by mail-wr1-x42b.google.com with SMTP id ffacd0b85a97d-482dbe4d247so177748f8f.2 for ; Thu, 03 Sep 2026 13:25:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1788467155; x=1789071955; darn=virtuozzo.com; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=BApIZZd2uO6w2g0GCq3PYBLmisA93SzAS7KiTyhYawU=; b=gFbLfU80D41RAU53DrnnEhA+SHGmeyG0GVJnABcyuSfRwNX3OPoC3/B+HeOJS6tYZA 79aAF1DZpiBKH8F1R8hmxlCljLeTW80IF1xf9xe77T3vwV2obSVVOeNUNPjNDP/XhTJz SZFTTuTPcN1cBXkY6EFCibV3SeaH6Jv9n+kfwTkLfWu5DDGUo1RVaV+7rCHUgBkfREYt vs0uqlQaYu9a0mOa2lQLUym9fHptrHsyjXyRPXiZ0TJGmoTU6pxYZWDC1iE4sgOgZGPs W4n+oKpJDJR9aLadI2t8CiBca6LE9a8D3dUipRWpOdY+GGTwpGMWyoCZhl0aCsRSC34/ pf4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467155; x=1789071955; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=BApIZZd2uO6w2g0GCq3PYBLmisA93SzAS7KiTyhYawU=; b=leT66LzWPGstTC9TX5pO3gA7ZRJ0uiyOXZbMJNmQqPofjdomsdEyucCNuCjnMWdaUu KA9kU2IH6/srTQtl9YXEQeTBDeuLj9VdySoq/NdKXCGAOYA6fyQSlcZraN4yPBs3Na4M 2SENA1/jJH2HLmoUBgoHXk4wQ9/xlIwq9DDoT8XiVHXeSaHEIQf/e4Gwo8xDk7LZS3XK sS7ffa7vNgs82EK70QznSr8yC2gDqODJ9/3jD1WjkcPvUUJdTzOiIhnYRqukn+PRxW+j 1lmZJf5VJjKJ8ijRxRqKDi5tAIp4w4s5yeqc/7fn2B2H1pnb5DU9WZFUv3+bK0NWo8b9 T93Q== X-Gm-Message-State: AFuF++kynJVgiYnHJFGzhU9OjTPZYVrSq+wFCIoWAxVoVzu4AsPJ4ywV PxJjqVOVyozIpsF6QXehWQWldts1Ovvwbgo+jABZkMKQiU+nxdmGxK1EvOv41np6Jpxupee56NM ey9nQl5w= X-Gm-Gg: AYBFou2IFQeH1wCSpvC4vPazHTPM6WfhuyEbk0JgizddTUuxX9vg4evuoGi7QPxC/C2 DBaYdl/MBsFa99lXRjfyLXNCDRO8W0Xa/AzYFpIdVwZw2vKZaxxGxQHsfa6dS7TX1dwtyhnwsyC 95Q9bGfosiH+gTgmFKdb8moX+63E2kpa3dGCEA+drVkB028eoq1Xx+CORemH/woa7eh/JR2O1yy 4p6LWsBYZqmaii2fLEofM8P2X02TJMZePieVKQhee/AqyncYpAb4h+d2L2XmodunDdARD90ua6Q HA0yeERhmQFcnHKxBgGvf8jzXZjDIvCelXEUnPkFFTLIOX7mHHBReR6MQmRa20XcLgjvalydSbB bEKhj9JHU4h5cGm25jzhkfg79EsmnK60B7hpcUW38babg4vxITsZAebDFs04UeVYlgaqRREbbU0 gcPGlttztVFgXzp8y5R6+PrVzSn4bJn7Mk7LA5s7+ldZkMV9wrEOykeq6I X-Received: by 2002:a05:6000:26d3:b0:485:8393:2176 with SMTP id ffacd0b85a97d-485870902eamr2883572f8f.21.1788467154983; Thu, 03 Sep 2026 13:25:54 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:83cc:ab98:cda9:7dc]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm950600f8f.8.2026.09.03.13.25.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Sep 2026 13:25:54 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: den@openvz.org Subject: [QEMU HCI-8.0 PATCH 3/7] hw/display/qxl: Fix mono cursor validation that can read past a cursor chunk #VSTOR-144000 Date: Thu, 3 Sep 2026 22:25:45 +0200 Message-ID: <20260903202549.2754937-4-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260903202549.2754937-1-den@openvz.org> References: <20260903202549.2754937-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 1 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:1 X-MS-TrafficTypeDiagnostic: DB1PEPF000509FD:EE_|GV1PR08MB10719:EE_|AM2PEPF00070CF5:EE_|GVXPR08MB7893:EE_|PAXPR08MB6942:EE_ X-MS-Office365-Filtering-Correlation-Id: e1a6bd23-d752-49d0-d785-08df09f996dd X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA|SL X-PERCEPTION-POINT-CUSTOM: vzpp X-Microsoft-Antispam-Untrusted: BCL:0;ARA:13230040|2092899012|82310400026|43022699015|12012899012|6059299003|3072899012|13003099007|19002099009|10067099003|5063699009|22082099003|57112099003|16102099003|55112099003|18002099003; X-Microsoft-Antispam-Message-Info-Original: =?utf-8?B?NWdSQitOSXRGblNGOFpHZ2lPWkhnU1NYRUQyREc2YzhVc3VUVUY5ZGl4aTdR?= =?utf-8?B?cFFqYlBwMkVlRTRxTVJ4OEFTN2xKVmNaa2RyMmJvVTFibklRV3AxZUJVRjhy?= =?utf-8?B?dWRUM2g0K1F1bStQUEFmQjZLUG5iZjdhM1BIeWlCY0dYRDFBcnU0TkthVTBp?= =?utf-8?B?b1BiMklZQkU2TWw4emFmVnJwUnJmeWdOOThrUkRhbHFsTFBVbjZ3V0dkaFg3?= =?utf-8?B?UEFRaTlTc2IyenpEUlAxNzRHYm1yTG9oVWNUK05tZU9YTlpXTUZpTW02TnVE?= =?utf-8?B?QW1yRjN2TXNiN0NxWE01OTdubUpyeHEyMTVua3JBem1KNjJZNERSZnNqWnE4?= =?utf-8?B?NzNkeHBEaXVNdmUyUTFQdStOdEsvQUg2NFBHcUs5RHB1QjZFTHZwOTJEQTlC?= =?utf-8?B?Mi93aXFweVVnTnpjY255VnorNUVVbllwNDRZTHcvZjlSRWtzR3QyaWdUbXhs?= =?utf-8?B?aFFLcXg1MUhFb005akI2RWZnQTFyWndwWmNlTlQ2RkdySHhsTkxrUjQwR0R2?= =?utf-8?B?OHdDOW54N3NjUkZyVE13QXBJdTUwdFZCdmZuMUlKaXdwbGJwT0pONGsyQWhv?= =?utf-8?B?UE03UXQrRHlBQS9Dcng0TEs1UGFRNW9DdmFuYXBMaU4ray9WZy8zdU9QZXJx?= =?utf-8?B?Y3NKUE5XYWlFWURJekpDNStmSWdNbDFFcjBueE1EcG5mTGV2c05US3VUT1VG?= =?utf-8?B?a3VoaTFQVUwrZnNKeEY4WmRJWmhUaTdEZHpIOFUwQkNYUU1mcHA2NmdpanUv?= =?utf-8?B?WDh0SGI3NkovK0paTFFIRldJamtQaGtwNEJTRDdYSE54RVdoOEgwZHl6SUtP?= =?utf-8?B?NUY5ZmlnTllNOUd3NzZoZEZ6dTJEQVczLy9DZlFhYWdlSFN4cjlIRUk2ZG1T?= =?utf-8?B?TmU2R0xLWWlmNUJLWDZBRGtTV3VzdFNmT1JwNmlnRUhYakNpMXU3MlJvVXA1?= =?utf-8?B?akVDc0plazlITkVsYzRKR1dITHBrcXBMUkdnY2pIVjhkYXMxMlBpNytTY3N1?= =?utf-8?B?dVJPa0pNTkJLRUdjemxIQnhNNWVlb002WUNNTDBQYk5CV1R0LzBqeG96Q1hu?= =?utf-8?B?YStRU0xldUZqWWNkNFhpRVRXdUhURU10ZzlwTC9vcThTSGk0a1N4TE1WeFlK?= =?utf-8?B?cld4dFQwbDNCbjlrQWJ1bXNwMlRvWkYvVnd2dEVVdURlRUNia3VCUlFCTVJW?= =?utf-8?B?RjFGZ1pxSVR4RXpXR2NMYlhiZlM3UXhEYStweEV2Y2Q0U3RiZjFQdnppNVpn?= =?utf-8?B?emxqMzgrOHV4YnBFWXdxQW9TQlVqcEp6UzdLRnh2cWgzOUZZeEFqcExodTRM?= =?utf-8?B?VWdFOU5OeXpjM0pzc09aUkFOd0tjSWxKQzN2cHd2S3l3RExSbG9FNFM3UWtM?= =?utf-8?B?VmRhSHY4SWI0d2p4MXVuanlXZjc2UjdwQkZaa1dWTVk5WTZLVzNTdmZ3aTdl?= =?utf-8?B?VTdFSzc2NVZqVks3V2VDd0RpUWlFeWI3UlhHSXVadHhJaGtvMkV5UEtGOXFj?= =?utf-8?B?RXRvVjZqSTdBV1Qzei9QeC8zc2czVmVncEIxZFNVb2NjSkJ0T0ltT242SVYv?= =?utf-8?B?UEFURWRuTkt0d1R5bEs0Qi9DODUybTlQSUxkN1pmbDlwRXQzR3NlSnEzcC9h?= =?utf-8?B?MFZnckNLOEhGUEl1dk4yT25vc3N0a2dmZmV6NjVpZCtnWUZJRkVZREV3QzhD?= =?utf-8?B?dnVKMEJZdUllTExkWDdXRW81cDNwQzhhZUVoN1lrWnlvRmRDbTZvY1hORVps?= =?utf-8?B?N0xsb1B6OXZhOG1hU3hncDhiN1AvRXhwVmRaQmt5czlSQmgwNlAvZWhqamIz?= =?utf-8?B?c0o0UWJBdU1ZNVpvckhTT3lURTduQzgyU2FkZmFwS2lpYzQzaGU5Q2hUV3Fj?= =?utf-8?B?eWxSL0dQQ0NQYk13YTY2bnd4eUZJYjFMOGVKQzE3TU1vYk5Ya21YL2I5M0U0?= =?utf-8?B?WlNzS0c5cE43QTgzTytVYTFHR2hYYnI3clQ4RFdMY1F2b0I4dEF2ejBDcnZM?= =?utf-8?B?b0ZYeVZRQlY4WEJIRm8vYnVweHpSVzg2Z0hCTjhwdzNtOXY5UnJ6VzYrWTZT?= =?utf-8?B?L0N2R01RbWpaSmhQTWgwdWQxdlBmaUFzcE5WYXpUWU5JdTlxSTZtMnRhalZq?= =?utf-8?B?Y1A0blZTR01ySS9pQ3ZZSjZVaHNUOG5GK3FNWE1sQ0U2dWpZRmh3aWZPdDhv?= =?utf-8?B?Mm1RRlBFazZpSGtUZExiUk9HaTNEL2wrbGtLb05hSXU3TTNOenZpMzV2MlFq?= =?utf-8?B?OTVCdjFlSnAxRUtMeWN6V2NrT2FlSjhRZlVaVThUUmFZWTVXL0tqb202Y3cr?= =?utf-8?B?bnJFWE1VSXBFWnhIaHl1a2RUemtJdmVwbERnTllIZmhlQWdQd2UvNmxVS2lT?= =?utf-8?B?UnRZR3NRSW85SUNiL0dvQmVHaXI2blZRNnVkY2YzRitSN1d1OHJpUTlURS9k?= =?utf-8?B?TDk2NEhBNnhiNHFyUDRhM3dKVklQeCs4czBpa1JvRUdvdkZYQnYyQ2p6STdV?= =?utf-8?B?dVd0ZmJNUklUekdDdkc2b0x6Zi92ekk1emZCYWZxNDgvTUZDSXRYT3E5R0x4?= =?utf-8?B?QkdvazNKby8zS1p0Smk3SHkvbmJsRGY1K0RERHBKYWcwOXlCWlBlWmsyUWpn?= =?utf-8?B?TVRTaFNtUHVZTFRlMWxrTGV2dUpNM2RmdkRDRDBEbFlxMkRwY25FQytBN1d2?= =?utf-8?B?dXhPK0JjWnJ4cWhEcmtQT0x6dEdqN1JYMmltRzY4NXQvZjlON3MrL1FaRENi?= =?utf-8?B?Q1Z4NmwrYWYwNHBPNmp5NGljdUxYc0hjektqN3h6MzF6ZGlWWGNibUErbURZ?= =?utf-8?Q?2ApiRLYea5m4DorU4LQtiz213wCddoz3H8haKWQCh7?= X-Forefront-Antispam-Report-Untrusted: CIP:2a00:1450:4864:20::42b;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42b.google.com;PTR:mail-wr1-x42b.google.com;CAT:NONE;SFS:(13230040)(2092899012)(82310400026)(43022699015)(12012899012)(6059299003)(3072899012)(13003099007)(19002099009)(10067099003)(5063699009)(22082099003)(57112099003)(16102099003)(55112099003)(18002099003);DIR:INB; X-Auto-Response-Suppress: DR, OOF, AutoReply X-Exchange-RoutingPolicyChecked: rf+HWzm4B0LPN4R0XxMElqZ7BBmCueVl0nJp5YpfOXE7Kgoh9S7GL/AOgs89na2iM2G00Jeyw3rc65ggJkl4BPMBbNVkeSjgwLkjTt0pEKkws7Hidx4q2RoUl6RyWgi/dqpJ89HevRrNJ83T9/FnFDQTiEvnnmkPJRPHGybN9DEymBiZWsNdO8yI2RZdBUcRn84o6XLI51tbfEPt7mEsr600mlLezyHpAf22bMNuORV5tm1qOdqDEJF4lv6j24T3jW2f/Stc6K2+3qfR/jUkCsgrrf9dIUU3xxTXgjvuh5XCE5spdv9tKv/IIXbVMPbVVyHV2HFXvFha6ADBp70X4Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR08MB10719 X-MS-Exchange-Organization-ExpirationStartTime: 03 Sep 2026 20:26:09.2527 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: e1a6bd23-d752-49d0-d785-08df09f996dd X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM2PEPF00070CF5.eurprd02.prod.outlook.com X-MS-PublicTrafficType: Email X-MS-Exchange-Organization-AuthSource: AM2PEPF00070CF5.eurprd02.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id-Prvs: fd81d29d-5d9f-4818-de2a-08df09f98ec6 X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230040|2092899012|82310400026|43022699015|12012899012|6059299003|35042699022|3072899012|13003099007|19002099009|56012099006|10067099003|5133699003|5063699009|22082099003|18003699003|16102099003|55112099003; X-Forefront-Antispam-Report: CIP:99.81.216.78;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:nat.eu.perception-point.io;PTR:nat2.eu.perception-point.io;CAT:NONE;SFS:(13230040)(2092899012)(82310400026)(43022699015)(12012899012)(6059299003)(35042699022)(3072899012)(13003099007)(19002099009)(56012099006)(10067099003)(5133699003)(5063699009)(22082099003)(18003699003)(16102099003)(55112099003);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Sep 2026 20:26:08.6556 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e1a6bd23-d752-49d0-d785-08df09f996dd X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AM2PEPF00070CF5.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVXPR08MB7893 X-MS-Exchange-Transport-EndToEndLatency: 00:00:06.5166944 X-MS-Exchange-Processed-By-BccFoldering: 15.21.0382.004 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003); X-Microsoft-Antispam-Message-Info: =?utf-8?B?OFp2MjhaWWdIdFJ2YVNNMXFNbkxPQnhvSzdrOWpOSU5LcFB2eW1XVit6WjB2?= =?utf-8?B?VDVyMHc4TFJtUW5VbDRqMTNKSVF5clRiK2M5TWVpRFNMZjhIVVd4Q2VrQkVX?= =?utf-8?B?QTVRYURBNlUzVjFFZjFqdzZNRUwrUFhyU3FmS2pLd0p2dis2MVFTT2hBNTFM?= =?utf-8?B?d1lXVDdDbEJJVnhKdXFLZ0FJTERleGpybFNtNE5JT25CZkJSblQxRzNJZ1hn?= =?utf-8?B?U3MydHpVSzh4MU43WVdLbVlVNCtSYmU0RmQxekp2di96YWtIOUExZnhZZ0la?= =?utf-8?B?UzJWUlc2ajJUYzEvb203RThtVGM4NmVOdkthWlE2RWRvUTJFdVNmSzZoaU82?= =?utf-8?B?MUV6NllFTU9pVVBITFVTWktCQzlmUFpBaWNFZmFjRmdBMUFXSExwV1hJZ0Jl?= =?utf-8?B?dGRkT2FxWmFPRkwzMFhYL3lpaU4zbkViR09iNE1KTXl2UjNQTG02Y0drcTls?= =?utf-8?B?d1h3QkFteXc3T0ZEZTdkMUpseEp0emRDZU53dythVU9kcGdCdStRWUd1OUFH?= =?utf-8?B?UE9uZmc5SDNsYkhjM0hORVAvRnZpOFB6blNSSjNWZWpESnkyK3ZaVGhBQW5J?= =?utf-8?B?aXA4TitSallKMGJsVEdrWGpoY3REZkFvUm5uUWNjOWhPUFlWZHA5NmxsdDYr?= =?utf-8?B?T2FCUGlESEwyangyWkRRK1k5SVN4SFQwRElwczFoSDVmUVZwckhBRXJEeHlm?= =?utf-8?B?RXBpOWhzTmVkNy8yQ3N0QlMycTJnTWtORzgrbXZrS2lNSTl4SW4yNFluaVpX?= =?utf-8?B?NDMzT1JXK3piRUU2T3lCaXFkc25QOW5tbG1YYkNhRjBWQlRiNW1WTnRZanpV?= =?utf-8?B?bVc4d2R5eC9DcCt0MVZBVU5BWXVNL2UzNGtuaGZINFlJVnhPQjM5ajN0SjlZ?= =?utf-8?B?VEZROEhBTnRFMU5wRXU3U3cvRThlYTBFUUdibHNHUVpwdEIrd0RzNTUyVXpy?= =?utf-8?B?aUwrWlNuYVFKN0FZN0wyODhCQVkyU2JzMUtXS1F6LzUvMUx2N0Y1UDAreUVn?= =?utf-8?B?aGRuTGpaQ0ZuRUV5V2JlSEcySnRBQkxHYVVjTTRnbVVkcG5qUE5VRUdqTGYv?= =?utf-8?B?bG5zMHdiY29WRmdnalYxTnYyTWJFZTVaWUcxcCs4MWcxRis5dXl1L3E0OEpE?= =?utf-8?B?ejlkd1RnUXByaWVsSzFETllpMmgxeFhPeVZEOXdKMFFBdXpTcE1lc3FidEdV?= =?utf-8?B?bzhjejFOVXpGNHNRVUlVTmRXa2xrZWVkVFN2Qjh0QTAxejB1cmVRb1ZseXpT?= =?utf-8?B?WjM4UzJLNHRyaEtyTEcwWTc2bnBaei92eGZvcjJYdW9zbFFaekQrWEdMakt3?= =?utf-8?B?bFVKY1RCYVFOditSSWZHWmtLR0Q1cndtMFhXcFJGZm41dndYeDRKaUZTZ1lM?= =?utf-8?B?bFhwa1cvUFRXRFpFbzNxR1FCSXhBRFV1ZDl1R0wrRmpCUTdabGkveDN6WlZy?= =?utf-8?B?bllDNHJ3UDN5QVdtQTJrSTl4eHJZTklmNk44RWpRSmxJdmtycExEcEV5c1l2?= =?utf-8?B?cUFVaHozVHpvRTZwY1Mwc29VUzJrSUxEK0YyWTBwUWxRWlhNMnJWK1dyYW9q?= =?utf-8?B?N2dGbzJpV3BEQWtLSE55ZDgyVUpscitseUFqVE9GWXZTdnlEVWRzYjd2cEM1?= =?utf-8?B?bzdpV05mSzhmUmdQY0NiSmtnMjArNWpwdTlJVGJXZ3VhRldweWoxNFVodjBi?= =?utf-8?B?SkZ1My9lYmxRSG1EZ2V0L1ExcWVCeUROcnFjQ3VXeEtaRDdPSjUvNW14djgr?= =?utf-8?B?eDMvd01JRzhwS1Q4Z0daK0ZSeTdNNXFYK1cwMG1wZEYvZFJGYWxXRDZPaWo3?= =?utf-8?B?MGtzYXBFZVRNMVowOW9ObjhlUlNqVjk0OWVwdEh6aVlFSHgvMndCS1M1UkVl?= =?utf-8?B?bmxiSGZwcmdJTXgwQmdLL25lVWE0Zkl3cGdmLzRKOWxzNUtaMG9CeTM0NkRr?= =?utf-8?B?aVpwcGtiVUZKSmEwQjAxYThFZU5DWm1IZk1QMWtlVnQ0aWUvSVA4RG91Ni9M?= =?utf-8?B?b0N3MlgzRnVoVjI2WmcrUU8vUE9CNkQxYWViZTdCeWQ5QjRyNlg5M09SUGZX?= =?utf-8?B?dThXWHNZVllhUUpseUd0MU4yVUppU0dZVStjZzFIUzRmYk5TOU80dklIbnRr?= =?utf-8?B?RkxtY1hsZ1JmUGI4cGlqeW5wU2NuTEMxM2lHTGtndExCVzZDTmU0dFBYUW1a?= =?utf-8?B?RjhqRlNXSE1MbiswMmpaTFg3NXNJeG40d3V1a0cvYTVGRWIrNEdmKzlZS016?= =?utf-8?B?NlBld3RkZEhwWis1R1MvUjYvRXVUMnNkMldLSXg4dTBMcHN5NDJUTnVoR29W?= =?utf-8?B?VW1WT2ZFT1UwYWdjVHAyd1ZyZjIvVi9VWEZmQUtScXBlNTdsOVZsUlQvOVV1?= =?utf-8?B?MUI3NGIvM01HNUtXQTFuc2NFNUxuQXhlekRXZUd6SFpVd290SVlWeXNzdWxS?= =?utf-8?B?M0hzZXNTbEU4Ui9rUStEcUtLWU1KRHNqZXp3a3ByRWd6ZzRTaEo4UkNGdEZ5?= =?utf-8?B?WXkvNWliR1BuU0FFaUhmMGxQcFN3bHB5QldsVW5KaENkMm1HSTdQQUJzVFJw?= =?utf-8?B?a1BsVkthZlYxQ3NhUzNrNnJHK29TODkvUjN5ckxzRFhIZEtGZXJIQ2dQdUNM?= =?utf-8?B?Y3dGTmRINFhBUGlraENSVXFMd0tIbThRMEpVOGpNMUdldUk4cHZHaXRxUFNM?= =?utf-8?B?Z0IxRUZCa0swRGFnYm1nRS9QYmp6a1FuUjB1bGR3aFNvNzJ6emQvL01pVE5R?= =?utf-8?B?WmZxcDB3ejErelFsMGdpcHFlSmM3WTN5Q3ZEMGtxeGRTc3ZuUXNUQzAvMTZj?= =?utf-8?B?UktZRCtuRGVnNTZRSjNrMHhrejVFdnJTQ28xaTJRcTJyOTFWMnhXbGFwMFNh?= =?utf-8?B?QmVBTXFrQk14TDRCMzNQZDdCS1FNQ1ZkN1U0SnlGSXo1VzYxRkJJdTNDMTBC?= =?utf-8?B?RWZXcHNyQndnTjBuMGRwdFlJRFpTUWtqVWtaeFJIYnBEc2V0UDRPWUxhZHFa?= =?utf-8?B?YzJWT3JGLzBvc1UxVmZRUUdORllDb1MyU01FS2xzRjg3RjUvRGZYbTdyRTEx?= =?utf-8?B?Y0Y5bXJBYmdueXYwZkdIZS9Geko4d1JIZmVpQnp2Um1PR3VvL215YmdOMWFq?= =?utf-8?B?NXlYNlhZT2h1RUdGZG5rMzI4SElUZ0dXUnFJNlpzNk9zc3d0UUZDSU1wMWpG?= =?utf-8?B?N2Q2MkxiYVhrdWJyWmNlWjdyeVV4MmZCaDIwZ1U3NUFXYjk2S29ESzNkellE?= =?utf-8?B?WWZWWEcvQUM1SnRvQTJ4eXl1RTlOQm04bXhURkZWbXpFZm5ISTNKbXJjdk01?= =?utf-8?B?MzlubzBEQU00QlI3WGJONkF6UnNyRW8vVEVnc1ExOGJtT2o4SlRRTnQveDNk?= =?utf-8?B?Qjl2RGxsT29SQkVtMDRXMHRJYlloSWJMOUFGSEpQRnZSYllDT2tNYkFPaWw0?= =?utf-8?B?QkpjQUdxUi9SNEVoMGU5bUxDVDQrcU1QczZIWVA0TUlBUy9qQWRJSndXSmlK?= =?utf-8?B?OXA1bjBldk56dmc5bUlmT3dZaGZ4L09iWjJvdTF1Z3JoY3d2UzRGc003NVA1?= =?utf-8?B?SjhIUUl5K3g3OFVISDVYUFA3bnoyeG9QVkNNM2tiTjFNS0t3UlpHc0xyZEo3?= =?utf-8?B?QTFYYlNRd1BkRG9JZ0NYUDd2VnVUM01naDFSYmVucVpYb2ZoZUZWaUNHK0hK?= =?utf-8?B?b1B4N1RPL0dDdz09?= MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: QEMU List-Id: From: Thomas Huth qxl_render_cursor() maps the guest-provided QXLCursor object using the guest-controlled cursor->chunk.data_size. For a mono cursor, qxl_cursor() then validates the expected bitmap size against cursor->data_size, but it does not validate that the first chunk actually contains that many bytes. A guest could set cursor->data_size to the correct full mono cursor size while setting cursor->chunk.data_size to zero. In that case, cursor_set_mono() reads the AND/XOR masks starting at cursor->chunk.data. If the cursor object is placed at the end of the QXL RAM BAR, those reads cross the mapped RAM region and could crash the QEMU process (e.g. under ASan). Fix it by double-checking cursor->chunk.data_size for the correct size. This patch is based on the suggested changes by the reporter in the bug ticket. Reported-by: huntr bubble Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3646 Signed-off-by: Thomas Huth Acked-by: Marc-André Lureau Message-ID: <20260630101022.379057-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 0e51b71c7b7706923536c1f7923cace82877932b) --- hw/display/qxl-render.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index c6a9ac1da10..1fe63b6f5ca 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -272,9 +272,11 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor, case SPICE_CURSOR_TYPE_MONO: /* Assume that the full cursor is available in a single chunk. */ size = 2 * cursor_get_mono_bpl(c) * c->height; - if (size != cursor->data_size) { - fprintf(stderr, "%s: bad monochrome cursor %ux%u with size %u\n", - __func__, c->width, c->height, cursor->data_size); + if (size != cursor->data_size || cursor->chunk.data_size < size) { + qxl_set_guest_bug(qxl, "%s: bad monochrome cursor %ux%u" + " data_size %u chunk_size %u", + __func__, c->width, c->height, + cursor->data_size, cursor->chunk.data_size); goto fail; } and_mask = cursor->chunk.data; -- 2.53.0