From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazon11021079.outbound.protection.outlook.com [40.107.130.79]) by lore.virtuozzo.com (Postfix) with ESMTPS id B436980275 for ; Fri, 4 Sep 2026 10:12:24 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=V08nDlARzTqhhkBlAhOK5Y1mQnKmNJLBQe8sWSrUaHLtROInftd3QbcUBlGDG5SmBMKZ14MNCD7RkokC78EtVO/I5MtPNj3FWJFLTsfeNsoeQnX8XyWJKjkNX5L7YknEupSSJSVDjKQ4eviw2fa9uJpl+JU+zBdVqJlsB7nzl634XtlesUCPz+5OKtNzcgJ1sRbhy1P82NonptYP+6JX17PmV+N2YkblaHqrAdUEiyPEvbKg9fadKd6c0cG8leAcaQUBvb6Sh8PQTyeVh2Yd4cI3C41xnBHLL3VOZpsaYAkekKAGN5vkhkstsd0HZerSBP1fbQyEjS5k4Tspb+iGCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=goF1xcq/SF4SUnjfC3Nce4J19nC+8q0S5to5qIFtZ4k=; b=nopAKePHKaKPkGy+xhjxLC37hAHWmyIiqL8pNEwwuMwtq8Xd2Bu1VUpCm8d7W7I4IL+jQZdXa0t0sO0VyZ25FE49+KybYnN0c+Zy8dTv0K0kl8K9ZD9GlYjy5yid0wo67PwFUOMPxhD7brv0QM0Qhkh0FCUwX4bhCUz7I3+H8G4B9SS5Tx17cUBbeT/5HesSKW088weGVooP7/2yKo8Be6R8Mu1GgpdkWorc92sgQ/HkQz7SqIRQJkkOEHelVZ7M/+28q+YTVG7acJb7pRJDuk2ZJBZnRhIMN8IULG0XTkDqtYTyx9JoNv6R+r1WVKQpue5AC3Kb6UKA1skh6sUYRw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=goF1xcq/SF4SUnjfC3Nce4J19nC+8q0S5to5qIFtZ4k=; b=pHXZnLwvf4tchXWSWiuZxpKpqQLEJuXDgPOfxCEUETCor2x1nTAPxTUOwkXVdCSXBRWOVZk48o8b+ZMaV4kF8x2rc0+r6xS7rJyGb2iiMh/9YdMo46iKaH2+v2Z6p6Uf2phrUEYC3oOwfD1ulsjSCMZ8kx5/dFACRbp81t9f3PLztBHUyuC+36GUbaIgzbauVBgF9zMhhZNlz9AV79N9Gwc0MsykctsUBTq2CpuVxBt1wdADlKLV8FB7uOSetWOoao+e4xJ2tV+Ka/8XALqcmGrqvbHwyapXfhpQrSXKhQQ0YCwt7K8tPiM8a5exXDU1DKZBqS/pVUkEY2gbtIVVqA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:23 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:23 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 07/15] ui/vnc: fix OOB write in vnc_refresh_lossy_rect Date: Fri, 4 Sep 2026 13:11:57 +0300 Message-ID: <20260904101206.701978-8-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: 7976b746-0470-4703-5bd9-08df0a6d016e X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: UH5e9wCvfkGjRTIt2uYDn1/HGEkwmaroObFRb29ryeZM43IdZOQQ+/A9xzwAKuDBcVr6F7iRq9Bgzg0F2hHIy2fVD0u/Los5LQVBiyd0VzXqgVrLc8kj1Cql2NEAFWtwqJBsOQ31CrOA1SxMpBHg6fR4AVHN0imKr3vWN5gdMbReoD9P+P7bEZ0yKhOCaqflSpnscMu+cqXP7bR6O7b0FP+CkYNpHX58NyWaTpxZr8LMDJiiFTYVN3DAKC3+PFhWhB4FkjH+QSJrp60gvdqCLA0PUjkofj4ovAo5+ZDdTv3QhRWdLJBGfCDbHWIbl3lZ1il2W9JBHCfWBgMO89ffo6v49jnBq8X+f/QS3wOugrUBI2hwqSMFhmgFrNYKvYsSVH/zTxv5LKBQh2hnXburPLfbF47QtyNIk/F/rjA+Z0k14jQuByPZmiolXlCt72qERLDvP8CRwu9VzUwW4B4pzbUXJZVJOkjD1mrolws0Y35G7oPTbtUof800ST6RUoYt5vKXcxWB2Fm7G0UDstsXn5ZkTMbXBdAFmfVfGv5uILf7kQd1bhGIHo/FuP4Jet4CSgY7hD9YqcNpBq8rp1sU09WNAIToLRNNppjuJBXfuDecdl9QGXX4KxMz38luMOLXLT/9qCVzVVn3w0Ko0qxuP1mQjL1hX1z/u7eT4CVyZVWN1DKlfJPNJJ2WXDwUz7R/l5YjrH3ez0IiCOfzVjm1bWOoDlm3wLCHMVlTdNQCn9E= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TjYxTGhBMVExdDRsNXFNNTFyVGRzNytpMGlmMVhEOUNtUnhCdXp6eHFWSnkx?= =?utf-8?B?VmJvZHp3cWVUTG9vcUlLWjZnbnAva2pSK0lqZUJJdGlwZHhxSHNuZHJmRC9P?= =?utf-8?B?K29DRVNpN2thSHFPajI1TWtTb1dCd3h5Z05KU1Y5cVZwL0YxcE42ZXNlSnd2?= =?utf-8?B?OTdCY25UVjV4SU0zNlJQSTd2TFBJOExETG4xZCtLdldNV0ZyeHFHc0lrZDRn?= =?utf-8?B?dG1FeHJvSmsvVi9pQUhHTkZJRUpnMFRNRVhjSmhHMkV2VnI1TWFLenpOaW5H?= =?utf-8?B?MmVadWlJQ0RwWWc2dmdPWTExRWZ5bXV6eVhBb21LakJwUDBiR2llM2hkTHRV?= =?utf-8?B?VitDK1lsTDFYcmRONTB6ZnlsNUdCMmRielcrVFZicWhjNWI2TlVuQ1FncVdO?= =?utf-8?B?bmp5YjdwSXJ4OFdpSVlrTzV5OFZ6Q085dTZla2pnMUJrUjNrMjRyaHpqOXYx?= =?utf-8?B?YmV6SXdWT0pVckpWRUFjdm9leEVYakg0MWhOTXNPTys4VEMzc3VDcXhoc1Jz?= =?utf-8?B?TnJuVTRsMnlvYXRSM2MwZ1dRWE1hbWp1V1pDU2p6NGJ1TDdmMFFaWDhuMjNC?= =?utf-8?B?eEtrSVBPaGoxcnlpNC9QdmFjRURzazFHN0hlbitNb282RjhHSUpmcG5ObC9z?= =?utf-8?B?L1JOWFhtZ0ZKVEVmOHhBeW1UZXI4eGVNOVVHS3pzUHRjWjR1eUZhOTBVdFda?= =?utf-8?B?VHAzY3BQd1BiU0NCT3BFVklzTXJpTThRZEFMUWl4VzNCQURrTExjUTFzNXo5?= =?utf-8?B?bmg0cVNmSkZpZ1pYbC9ralpmajJTS09RK1dycmMveXZJWW9kS0dSWW1WTmdC?= =?utf-8?B?djRRaWhMbkJwQi9mbW5nOVVCbnlwOWJlVWVzdzFHVWRhZG5XSjZ5YVFYd3RB?= =?utf-8?B?QTFTZU13dVNQZFErb3hlc3RybWFMRGJ5eFBCclZITHBTZEpmUngyYXFxQkdR?= =?utf-8?B?NW91dXBZMjBDOENtWVVPU0YvZkhnRnA1OU9MQU1zUWl5YWd1VW9BUThuQlp0?= =?utf-8?B?dVo0bWQ1WXUzZmpoOW9kdGt0MXRxcjZHVk9ZbVg4YWFSR0JKdU4rbldhczdt?= =?utf-8?B?dTlkTXVodVVaeHcyNTZUOHJFNlRPV29ZZWdOZG1jcUY5VnMvTjluRU5xNDA0?= =?utf-8?B?di9DOFo0YWpZbHFSYThPcUpKbWZuODJQdG1zdTZHSnA5dFVEenZGT3JIdVdo?= =?utf-8?B?Q2NpaFlxMjhNRWxncDBRRlhheStBOTZDUUM5Zlp0ZGpPUittY25BS092d2dN?= =?utf-8?B?d2RRTkVTeFR1azR2dndhU0h5TjMxRlBQQXFlNUF2RjN0aFBhazZYRlgxeDlG?= =?utf-8?B?V0JleXVzUlRoL0NVTmYwYUxPY0V6SlAvb1pXeHRhZnNMTjVVd1ZEcWVEWmVn?= =?utf-8?B?YmtlTmxYaGZpdS9KTE9UQUhlRWF2M3BZTk1JZW4ydTNyWHdoZVhoWlloUUxa?= =?utf-8?B?WEl0T3llYTJWVW5aUytRUUpBcGMzaU4xYnZ6N3FPWHp5WlpWODJDQzVsMWV5?= =?utf-8?B?NEFNaGFlK3c5QlBLOUlGOHhYV3o2RXNTRnJqeTNCOFc1YmF6bGt2M1BqUWZ3?= =?utf-8?B?ejBIOFI2Q0x6c2tjNkdPWGhIQXBrNE1heFhkNytjemJVUldqUktnQitRdFVm?= =?utf-8?B?R3VuVVNYZi9yQ0hEbTBRek00R3VUOHFNeHJSKzRWaFVqSFBsQnJxblEvTi9n?= =?utf-8?B?U0p4cEo0SW1tRzJ5Q2ttbzBPWjdYTkR4VG9FMDJIazhCNG1Eb1R0ZkdUQ3ly?= =?utf-8?B?d2JNOUpLQ0hDUnJoK2tpazkrQmt6eGUwcFY0Wk1pUW9DM1ovMDVDUXpSN1Iw?= =?utf-8?B?Uk9IcVJBbVg5SHkrNmZtWk4wT1ppdEhNc1cyV1BiMG9yMGc5b3FnUkx6eDFq?= =?utf-8?B?OGphMUNJYURReXJtOFR3WWpDanExcEplZmFwZEFJd0YwWFRLV1lMQTljcWZ3?= =?utf-8?B?UHdNOHBXVy9EL0lPUDhtT2cwNStDSnRPalpjTTdyL1ZTOUNZYmltQzFCMTJy?= =?utf-8?B?eWNwRWQ5dk5SNnk2TmxZemsxb0Q0dTNEMGVnbGkzWHIzcXZTcEZBb05xemU0?= =?utf-8?B?V2x3M2c2WHhhbHp5dFJpL1JmUVpRRllPREgydlFTb3dMQVREZzdYNWJBb1dx?= =?utf-8?B?bWl1UkpYWm1rN0JQek9zU21KaE01b1VoQ1lHT1N0ckttL1dtUmpJNDJtaTNY?= =?utf-8?B?OUpTT0kwSkpZOGdxc0kvQVRreThMTDRlUDVXZ3NqcmszbXdtOVAxMjdjTUtI?= =?utf-8?B?L2I2SnZhVUJhRE1ienFyUGVibzBZUHRUb243M1ArNE96YUlvS3psdk1VVU92?= =?utf-8?B?dHdxb2RpU211N3JLODkyYmp6eTFxQ2pjdnBSdGlqWjczYXRsODF5elAxK1ZS?= =?utf-8?Q?3L5Zy6oiRTvZjhW8=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7976b746-0470-4703-5bd9-08df0a6d016e X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:20.3092 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: mpfiPRpRGSJl7YRaZu63y7dFDfaXvQbiAoVOgDxxsJRx1x5kr2KXzZ/qKKwIrSNcNJA564MLPIaqMOqElUo5lKbMfilZfKXS7xIbI15XwDg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Marc-André Lureau vnc_refresh_lossy_rect() always marks a full VNC_STAT_RECT (64) rows as dirty when refreshing a lossy tile. When the display height is not a multiple of VNC_STAT_RECT (e.g. VNC_MAX_HEIGHT = 2160), the bottom tile is partial -- the last tile at y=2112 has only 48 valid rows. The unclamped loop writes to vs->dirty[2160..2175], past the end of the VNC_MAX_HEIGHT-sized array. Clamp the row count to the actual surface height so partial bottom tiles only mark valid dirty bitmap entries. Fixes: CVE-2026-48002 Fixes: 7d964c9d2fc6 ("vnc: refresh lossy rect after a given timeout") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3950 Reported-by: huntr bubble Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Marc-Andre Lureau (cherry picked from commit 3543c2b855cc8cd25a5dbf05564a47ba42f45fad) --- ui/vnc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/ui/vnc.c b/ui/vnc.c index abc83a46e32..859c5df4e52 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -3025,10 +3025,18 @@ static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) int sty = y / VNC_STAT_RECT; int stx = x / VNC_STAT_RECT; int has_dirty = 0; + int height = MIN(pixman_image_get_height(vd->guest.fb), + pixman_image_get_height(vd->server)); + int rows; y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); + rows = MIN(VNC_STAT_RECT, height - y); + if (rows <= 0) { + return 0; + } + QTAILQ_FOREACH(vs, &vd->clients, next) { VncConnection *vc = container_of(vs, VncConnection, vs); int j; @@ -3043,7 +3051,7 @@ static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) } vc->worker.lossy_rect[sty][stx] = 0; - for (j = 0; j < VNC_STAT_RECT; ++j) { + for (j = 0; j < rows; ++j) { bitmap_set(vs->dirty[y + j], x / VNC_DIRTY_PIXELS_PER_BIT, VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT); -- 2.47.1