On 7/17/26 14:52, Marc-André Lureau wrote:
...
Akihiko Odaki (3):
ui/gtk: Narrow DMA-BUF critical section
hw/display/virtio-gpu: reject strides exceeding INT_MAX
hw/display/virtio-gpu: Check pixman_image_create_bits() results
Marc-André Lureau (12):
i386/tdx: fix uninitialized variable warning in tdx_check_features
ui/vnc: fix OOB write in vnc_refresh_lossy_rect
ui/vnc: validate color shifts in SetPixelFormat
ui/vnc: use RFB wire types for client message handlers
ui/input-barrier: fix off-by-one in keycode bounds check
ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
ui/vnc: validate SetPixelFormat field ranges
hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
hw/display/virtio-gpu: validate stride against width on scanout
hw/display/virtio-gpu: cap submit_3d command buffer allocation
hw/display/virtio-gpu: handle migration iov allocation failure
From this batch, I'm NOT picking up for stable:
i386/tdx: fix uninitialized variable warning in tdx_check_features
ui/vnc: use RFB wire types for client message handlers
(this one I'm not certain, maybe I should pick it up too)
queued, waiting for an addiitonal fix to land:
hw/display/virtio-gpu: validate stride against width on scanout
(as discussed)
hw/display/virtio-gpu: reject strides exceeding INT_MAX
(context depends on the previous one)
the rest are queued up for 10.0.x and 11.0.x.
BTW, a few of them, namely:
hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
has already been merged through misc tree.
Thanks,
/mjt
