From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
To: svt-core@virtuozzo.com
Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org
Subject: [QEMU HCI-8.0 PATCH 00/15] VNC stability fixes
Date: Fri, 4 Sep 2026 13:11:50 +0300 [thread overview]
Message-ID: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> (raw)
These are VNC CVE/stability fixes, all cherry-picked from master or
qemu-stable.
AlanoSong@163.com (1):
ui/vnc: Fix qemu abort when query vnc info
Daniel P. Berrangé (4):
ui/vnc: fix OOB read access in VNC SASL mechname array
ui/vnc: fix OOB write in VNC stats array
ui/vnc: fix OOB write in lossy rect worker code
ui/vnc: fix OOB read updating VNC update frequency stats
Heechan Kang (1):
ui: fix validation of VNC extended clipboard data length
Marc-André Lureau (8):
ui/vnc-jobs: fix VncRectEntry leak on job cleanup
ui/vnc: fix OOB write in vnc_refresh_lossy_rect
ui/vnc: validate color shifts in SetPixelFormat
ui/vnc: use RFB wire types for client message handlers
ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
ui/vnc: validate SetPixelFormat field ranges
ui/vnc: remove redundant rows computation
ui/spice: fix crash when disabling GL scanout on
Thomas Huth (1):
ui/vnc: Fix crash when specifying [vnc] without id in the config file
ui/spice-display.c | 4 +-
ui/vnc-auth-sasl.c | 2 +
ui/vnc-clipboard.c | 9 +++-
ui/vnc-jobs.c | 19 +++++++-
ui/vnc.c | 107 +++++++++++++++++++++++++++------------------
ui/vnc.h | 4 +-
6 files changed, 96 insertions(+), 49 deletions(-)
--
2.47.1
next reply other threads:[~2026-09-04 10:12 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 10:11 Andrey Drobyshev [this message]
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 01/15] ui/vnc-jobs: fix VncRectEntry leak on job cleanup Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 02/15] ui/vnc: fix OOB read access in VNC SASL mechname array Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 03/15] ui/vnc: fix OOB write in VNC stats array Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 04/15] ui/vnc: fix OOB write in lossy rect worker code Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 05/15] ui/vnc: fix OOB read updating VNC update frequency stats Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 06/15] ui: fix validation of VNC extended clipboard data length Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 07/15] ui/vnc: fix OOB write in vnc_refresh_lossy_rect Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 08/15] ui/vnc: validate color shifts in SetPixelFormat Andrey Drobyshev
2026-09-04 10:11 ` [QEMU HCI-8.0 PATCH 09/15] ui/vnc: use RFB wire types for client message handlers Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 10/15] ui/vnc: fix out-of-bounds write in lossy refresh dirty marking Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 11/15] ui/vnc: validate SetPixelFormat field ranges Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 12/15] ui/vnc: remove redundant rows computation Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 13/15] ui/vnc: Fix crash when specifying [vnc] without id in the config file Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 14/15] ui/vnc: Fix qemu abort when query vnc info Andrey Drobyshev
2026-09-04 10:12 ` [QEMU HCI-8.0 PATCH 15/15] ui/spice: fix crash when disabling GL scanout on Andrey Drobyshev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904101206.701978-1-andrey.drobyshev@virtuozzo.com \
--to=andrey.drobyshev@virtuozzo.com \
--cc=den@openvz.org \
--cc=svt-core@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox