From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazon11021113.outbound.protection.outlook.com [40.107.130.113]) by lore.virtuozzo.com (Postfix) with ESMTPS id 3983480275 for ; Fri, 4 Sep 2026 10:12:25 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=woiu4Tn03Gns/Y+1dHh42xukbA4dYMCfMHVDazJNH88mBru65tk79HTVt8IEZvA0T5UAiaPhHoTdfcHwGmqvTXpCRQiHF4/Ml67g1KU59l7gTf/bvTeHb61cCKunV1LGJZ1H33YuJNqQCY6NFn07Ouhoqrra6KjtSA4zf9a1k45KwOLaYPYk6R7gJiDYuqgdy0vP29ZA9u6QjrbuVtzHdYVoZAQar9NexMVarRpNo9f31rB9P/hZy3LqGuvf2yl4efMNdIGRMX/ZEufHtUSGCo7CwAm1bOyDFTd1yHy/ftbM5IFfbW8kLaxbKOsnhqk8IX3A0XOwskZm24ZU1/fOOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=G5P6tPFWSgXo9eEo9Km80knL3Hh40t37pKpQYOFdoa4=; b=salnzt1cxXSQtFw4fXCdHB/vqA55x+UPl2endcAr8CzTGoQjTB/xb9W49BcjNKtbW0dCP9ZDJJMtmp7WgwEUq1t4ZZqLJ2qk5lc+jHmtlAV291lOFDBDd6mg4G/aVnYm3dEu9gFIQLGfmdtDBtKYghD7CFExMa3dahFJpkuxaWt3qaRDr3i5rNjW6c09RJgDP2d5OrUjtIIL7DaShhZU1zZv7wuxySYAfoMT/ddoBQaMdrtvn3dX9lb7ijHZa+L5PKbUaVI4fm7b2yrgHBUgyLJdhMwRIUHY+yjrnVOUX3H1bNQPpHw9WN7sNL5f+bTy1eo/Y/5+3KVvt7doGoBaFQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G5P6tPFWSgXo9eEo9Km80knL3Hh40t37pKpQYOFdoa4=; b=sIHJ5ie4EvmEhOEjCAii3CaNyFHiiUQb8Tkz89F+Bktb42vMhZIIuE5WTpFrMGMgkbI8a/RY9P9FzIIp2GAbLBzlWTaSvKtmq61xKwsA1fV58g8xJcv/f/KPBiWhZ2Rzv7hVfUt4DUDJ8GQW77GLwLVSbj6LasriZSKizNWckucAbNJPoZ3WrYEvn55BX7d9g62NFue6HrNZ0dqjXt9hasGCnyw2vaDPjEwTESmUTsnVLbUsqey/sWO/7di4GqvLquSsjhVwiZxNwMTp3zZfDStyO5H7g4MTE/FFUlCOmcAgDRYcY3RZkcqjeGFtnxa35qu9CsSGEURyCRZfG4x7hg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:24 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:23 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 08/15] ui/vnc: validate color shifts in SetPixelFormat Date: Fri, 4 Sep 2026 13:11:58 +0300 Message-ID: <20260904101206.701978-9-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: 54b1483e-0c35-41fe-d7fc-08df0a6d01ad X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: /OXS60OfsCORqKf+CESqtdQYueR3vWO3Hg57QCTqR8c/PRaO3t0HtKuRAhwsjSEZqwnaQk6l5ShMkT5RWPnFOTUL0COpJo3JjWqIWT1Nb9JCa+o/pPd0ncjMM75r1n+Pw4J597fzkCyJWs5ADXIbc/3Z8cUM6BwvYz+ZF1a0YAI29EGCYECOrc9GoHCFDhC7QAxgri1g2TfQoH3SZHzqJzBkpWgdbEQ6lAoi99abAJCAZ8RfwjGwMlNbwoj4nAkjeI9NSjKTXYrebt5i5cljQky+ALYtUHnJiZ2k+F/XIO8AJMP6/WOP9xhSOTT3TSOE726+a+k8Day0KciiUvGO8BNHC4LbRJfYME0CYuuNfZoNpbQY2hiStyo1Z9oxGVqu6aFj6XBYfPuIQ1I36qL6LC7Xtz8z/HYexiLPQpPoqaAeIReeBhj1tdEky97KlKujsV/jjj5w4EYU6HL9HKEcs40wtu/VY/Adlh+znet3lYxlvk9ZBxEpgEMVQY8wci1/I0PGSk+vcAaRGlMdG9gevf8VOFPeXeQ+18G02qGyEnEKknrkGSFo0teMBGs9oKvzBb02taykWFwsGfB5C7Kx5OVkb6O1kndTv28W4X431MqbHu8gb2qu6t9oTRKBhOc0SuBgUaVYB8zbo3JdzJpv3zQm3/iwfz6ig7aXFC8ReyLvltskjAYXDdpmtDQQz/RiV9TA82ocpHmuFZNxtkDGpr6EX6UgC8BOlVC1xKd/PME= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZFY4dm9KTXpPdjJRSm9LaUgvWWIwWTFuQnp0SWJaQmNheU0yejhoQ3hrMkhP?= =?utf-8?B?NjgrWmM4UXorakRWUG5MbmhOV3BjRldIYjg3dk5vUGZJUmMxaktyUTVDengv?= =?utf-8?B?VEp3emNIS3ZVQXg2eU5kSWRxcWZIMS8zdGovdGdlSzUyNW0ybi9hVFFCWlR2?= =?utf-8?B?c2JkTks1bWsxMGlKN3VhYmg1ZzlWd3hnRnR5dTNMWUNQNURFN3dESjkvZ0tM?= =?utf-8?B?cjlPemdYYWJ2c1gzbDRUS2s1enNzS3ZGMFI2Tnh6dVdWR3R3cXJDOUNOKzZM?= =?utf-8?B?R2NGN2UvS1JwaFp3VDNZOGVOWENTT1VCbWxzSUN1eTQ4NEYxMFBaL1lsQTc2?= =?utf-8?B?Rm5lM05McEY2VjUxbmhoeFZ5dm9SN2NVYzFtdU93MUlLZFN3R0p0eTRKaE5n?= =?utf-8?B?YjJsS05jd2FVWXcyVktCbXZjWk10aCszU3VaSEdZMjNtNFVwMTVzb0d6T1Er?= =?utf-8?B?SU1XMEwwL2hhMlV4TFE3K2JuRE9ZOHRpa0NCMC8zOGYxSE1oWkhoR2E3ak5B?= =?utf-8?B?UjFSYm05WHloU2p6NUhsU3R6aEUvUnBINndpdWttb3JMc0dSbFM3ZklWMjZ4?= =?utf-8?B?cjFrR0xMZHZTL0ViQXI4dnZmSzV6SjU3OXdTaDUzSGdkMTE1bkV0dGNiUkh2?= =?utf-8?B?UklTOHZKck8rRG1wLzMvQlNvYWw3b2VISmI3UnJxaE1HN1pNL1dEODNNNTVi?= =?utf-8?B?S1hpaTdRdzFIbjdaZ01LNmJML3k4dXN6dHNwSUhGVWxsQ042NEJkY3dDcGh3?= =?utf-8?B?eStMTUU5ZEFySFAvbGx5YzA2akFlV1JtbTRWUTJ0Z2RhUitNTmpPc0xaRmlH?= =?utf-8?B?WDFZcGNjSHJWdjBhdUNVRjRqTTlFdUcrMXkzTkppeGVzUThHbXFOazZtTWE3?= =?utf-8?B?dnhaRURpcVZkK2wvTDNQdGZwU0ZSQmdzZmY2UUN3SmliQTFsTDBmV1I5NFUw?= =?utf-8?B?VEhUY1A5UHE3YWYzQ3lTdHI0dTh3KzVIUjFGM25kWFNUN2hZUHByUFFkSVpP?= =?utf-8?B?Q2ZBVjlKWjFPa0diLzJ3OC84NElCSWdxRHJlZkNjMHVzZ3VwY1U3ODNDKzBy?= =?utf-8?B?YzZ3OURqY240TXZwTFc5S0dZemVsdHVZRFZWaGI5c0RCdHdIOHRrZTZHRm9i?= =?utf-8?B?R29xRnlObWRWVmh3N2I3K3dTOGo3aUM0S1VjeGxoMFJEZ2g0QmZsWkh3SlBJ?= =?utf-8?B?aHZrbGNVcDJ4WWQ4ZEgxOE5heWJXWXNnUWRKZ285cnJHeTdDSXVCVXUyMDJO?= =?utf-8?B?cmYxZjE1RmtKeTJ2YmdqOWo4T3BpWHJPQkNNZk5uMWwvOXVZQUh5cGtNWVAv?= =?utf-8?B?VFBqclpmU25Mb0x2WjNLUGRTUFd0ZkZRZEx3ZG8xTncweWF4VkM3Z1o0NVF0?= =?utf-8?B?ak01SmxUazkzQVNSWDRKTVFlODRLL0Z5RU5vRWx2d3d4ZW5NbFpUeFJ4dVln?= =?utf-8?B?VEZjcDR2RGpTUk1MNU5DbGFyQm9CZmNpYVJ4RHl3T2NrWVl2Zm5BSmJ2aXlE?= =?utf-8?B?Z1RMMFk1c3F0eE5KSlIveE5TMWtacXRwZGV1RU9QYmFnVmJMeldJa2pLUThh?= =?utf-8?B?ekRBT0dTV1VOK2wrdzZsZ2ZVdmphMnp4Mi9zNEt4b21KYnVYRXZueVB4TVd4?= =?utf-8?B?WEVCeFhsbFdWUkpjcnlrZG1JaE81WitVQVZ2RHZKeGJ5RWxhUlBWcmlZUHRl?= =?utf-8?B?STU5OG1iUVhFWGlsSzMrMTFRUHV0dHJuS1BxQlArTXA5Ti8waTBXS2Z6NFNV?= =?utf-8?B?cVM2MmhLWGZpSG53b3dDTFZJNURTZmFHMnh5MEdMZVlJZW5CWnRlNDRRSEVp?= =?utf-8?B?dC9mNUY5cEQ4OEpoekVaRFFFa2h6aWZCRmRaZzNNOC9nWE5tSmROanNSOFpp?= =?utf-8?B?QncrOVdGYkUwSUN4QndkM1lUQlVJaU8vdGdsYUpqWU5hbWdxMGVDMGxsVHpU?= =?utf-8?B?UlNNdjQrczY4U3RNdkVsMTk5QzI5NzFhMTN4MkRPUW53dzJOMlU1Yk56dFN1?= =?utf-8?B?TldYekxDNElBY3UwNlFKekJUek9MdUF3SVBIOUxzNXZXQmZTTVRLLzJyV1Jp?= =?utf-8?B?TnVSZTlGZEdqbERxeEZTY1N1VXZzbnVZaUZZUU50QlUxRUdoUDhaL2ZOMFBO?= =?utf-8?B?cDJmUlRVbjh3anEwZTdDQS80YzNqQnBlV3Q0aHhLRk5pTWQ0VUFqQ1ZQTytl?= =?utf-8?B?a2l5Nys2Q1pib016K3dwMGxWYUlIdGYxL1NPalBWbGxsMVUyMFA1VHQvU1Ji?= =?utf-8?B?dmxzNTg5Q1pxTXZiV2ROWDZ6bk9EU080TGFITE5TQnFWanZvR3BwbTVFQVVr?= =?utf-8?B?cTcvRlhQbVczd3pyN3FHZGl3K2ZxNU1HS1FYSjBKcUdtbzVVa0svUjJpVUhp?= =?utf-8?Q?TjokOYMz9UY0FGcE=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 54b1483e-0c35-41fe-d7fc-08df0a6d01ad X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:20.7226 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: xQgdxIzO3oEojxZDucsT55SOOglRbFFRvX23y989IdJ0xlM7K5EZHpUj1ssUxEkPxGsxjkh0LrHdXVJ6qBcdwZV5/yzQFfM/7cFDwKvfrEU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Marc-André Lureau A malicious VNC client can send a SetPixelFormat message with shift values >= 32, causing UB mask computation (e.g. red_max << red_shift where red_shift is 255). Apparently, this is not covered by -fwrapv. Reject color shifts >= bits_per_pixel || 32 before computing masks. Fixes: 9f64916da20 ("pixman/vnc: use pixman images in vnc.") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3948 Reported-by: huntr bubble Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Marc-Andre Lureau (cherry picked from commit fb71c895d7ff3c68f228095b5e6494e6c23b6a0b) --- ui/vnc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ui/vnc.c b/ui/vnc.c index 859c5df4e52..a311f74e8b9 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2293,6 +2293,13 @@ static void set_pixel_format(VncState *vs, int bits_per_pixel, return; } + if (red_shift >= bits_per_pixel || red_shift >= 32 || + green_shift >= bits_per_pixel || green_shift >= 32 || + blue_shift >= bits_per_pixel || blue_shift >= 32) { + vnc_client_error(vs); + return; + } + vs->client_pf.rmax = red_max ? red_max : 0xFF; vs->client_pf.rbits = ctpopl(red_max); vs->client_pf.rshift = red_shift; -- 2.47.1