On Fri, 17 Jul 2026 at 12:54, Marc-André Lureau <[email protected]> wrote: > > vnc_refresh_lossy_rect() marks a full VNC_STAT_RECT (64) rows of the > dirty bitmap when refreshing a lossy tile. When the display height is > not a multiple of VNC_STAT_RECT, the last tile row is a partial tile and > the loop writes past the end of vs->dirty[VNC_MAX_HEIGHT]. > > For example, with a 2160-pixel-high display (VNC_MAX_HEIGHT), the last > stat tile starts at y=2112. The unconditional 64-row loop writes rows > 2112..2175, overflowing 16 rows (640 bytes) past the dirty bitmap into > subsequent VncState fields. > > Fix by passing the effective display height into > vnc_refresh_lossy_rect() and clamping the inner loop. > > Fixes: CVE-2026-61475 > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3935 > Reported-by: "Vulnerability Report" <[email protected]> > Reviewed-by: Philippe Mathieu-Daudé <[email protected]> > Signed-off-by: Marc-Andre Lureau <[email protected]> > --- > ui/vnc.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/ui/vnc.c b/ui/vnc.c > index 8d91cee4d9f..c957731877f 100644 > --- a/ui/vnc.c > +++ b/ui/vnc.c > @@ -3000,18 +3000,18 @@ void vnc_sent_lossy_rect(VncWorker *worker, int x, > int y, int w, int h) > } > } > > -static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) > +static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y, > + int height) > { > VncState *vs; > int sty = y / VNC_STAT_RECT; > int stx = x / VNC_STAT_RECT; > int has_dirty = 0; > - int height = MIN(pixman_image_get_height(vd->guest.fb), > - pixman_image_get_height(vd->server)); > int rows; > > y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); > x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); > + rows = MIN(VNC_STAT_RECT, height - y);
Hi. Coverity points out (CID 1664010) that this added line... > rows = MIN(VNC_STAT_RECT, height - y); ...is a duplicate of this pre-existing line, so it does nothing. Were you intending to clamp a different variable here ? thanks -- PMM
