On 13/7/26 12:00, [email protected] wrote:
From: Marc-André Lureau <[email protected]>
The VNC SetPixelFormat message carries red/green/blue_max as 16-bit
values, but PixelFormat stores them as uint8_t. A client sending a
max value above 255 (e.g. 0x0100) passes the existing non-zero check
but silently truncates to 0 on assignment, leading to a division by
zero in the Tight PNG palette path.
Similarly, the shift values are read as uint8_t from the wire but
used in left-shift expressions (red_max << red_shift). Shifts >= 32
are undefined behavior in C for 32-bit operands.
Add explicit range checks for both: reject the connection if any
channel max exceeds UINT8_MAX, or any shift is >= 32.
Fixes: CVE-2026-15578
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3976
Reported-by: dong ling
Signed-off-by: Marc-Andre Lureau <[email protected]>
---
ui/vnc.c | 10 ++++++++++
1 file changed, 10 insertions(+)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
