From: Daniel P. Berrangé <[email protected]> Incorrect calculation of the boundary condition when tracking lossy rectangles in the worker thread will result in an OOB write which can corrupt further worker state, and/or trigger any guard pages that may lie beyond the VncWorker struct. This can be triggered through careful choice of the display resolution in the guest OS by an unprivileged user.
Fixes: CVE-2026-48002 Reported-by: Marc-André Lureau <[email protected]> Signed-off-by: Daniel P. Berrangé <[email protected]> Message-ID: <[email protected]> [Marc-André - added assert() suggest by [email protected]] Signed-off-by: Marc-André Lureau <[email protected]> (cherry picked from commit 46ee49034d26d04d95ba8f3183d4fbfa9d2b89b4) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/ui/vnc.c b/ui/vnc.c index ccc73bd7aa..8ab44c830c 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2994,13 +2994,15 @@ void vnc_sent_lossy_rect(VncWorker *worker, int x, int y, int w, int h) { int i, j; - w = (x + w) / VNC_STAT_RECT; - h = (y + h) / VNC_STAT_RECT; + w = DIV_ROUND_UP((x + w), VNC_STAT_RECT); + h = DIV_ROUND_UP((y + h), VNC_STAT_RECT); + assert(h <= VNC_STAT_ROWS); + assert(w <= VNC_STAT_COLS); x /= VNC_STAT_RECT; y /= VNC_STAT_RECT; - for (j = y; j <= h; j++) { - for (i = x; i <= w; i++) { + for (j = y; j < h; j++) { + for (i = x; i < w; i++) { worker->lossy_rect[j][i] = 1; } } -- 2.47.3
