Hi On Tue, Jul 21, 2026 at 12:18 PM Peter Maydell <[email protected]> wrote: > > On Fri, 17 Jul 2026 at 12:54, Marc-André Lureau > <[email protected]> wrote: > > > > vnc_refresh_lossy_rect() marks a full VNC_STAT_RECT (64) rows of the > > dirty bitmap when refreshing a lossy tile. When the display height is > > not a multiple of VNC_STAT_RECT, the last tile row is a partial tile and > > the loop writes past the end of vs->dirty[VNC_MAX_HEIGHT]. > > > > For example, with a 2160-pixel-high display (VNC_MAX_HEIGHT), the last > > stat tile starts at y=2112. The unconditional 64-row loop writes rows > > 2112..2175, overflowing 16 rows (640 bytes) past the dirty bitmap into > > subsequent VncState fields. > > > > Fix by passing the effective display height into > > vnc_refresh_lossy_rect() and clamping the inner loop. > > > > Fixes: CVE-2026-61475 > > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3935 > > Reported-by: "Vulnerability Report" <[email protected]> > > Reviewed-by: Philippe Mathieu-Daudé <[email protected]> > > Signed-off-by: Marc-Andre Lureau <[email protected]> > > --- > > ui/vnc.c | 8 ++++---- > > 1 file changed, 4 insertions(+), 4 deletions(-) > > > > diff --git a/ui/vnc.c b/ui/vnc.c > > index 8d91cee4d9f..c957731877f 100644 > > --- a/ui/vnc.c > > +++ b/ui/vnc.c > > @@ -3000,18 +3000,18 @@ void vnc_sent_lossy_rect(VncWorker *worker, int x, > > int y, int w, int h) > > } > > } > > > > -static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) > > +static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y, > > + int height) > > { > > VncState *vs; > > int sty = y / VNC_STAT_RECT; > > int stx = x / VNC_STAT_RECT; > > int has_dirty = 0; > > - int height = MIN(pixman_image_get_height(vd->guest.fb), > > - pixman_image_get_height(vd->server)); > > int rows; > > > > y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); > > x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); > > + rows = MIN(VNC_STAT_RECT, height - y); > > Hi. Coverity points out (CID 1664010) that this added line... > > > rows = MIN(VNC_STAT_RECT, height - y); > > ...is a duplicate of this pre-existing line, so it does nothing. > > Were you intending to clamp a different variable here ?
it's a rebase/merge mistake, original patch: https://patchew.org/QEMU/[email protected]/ Are you sending a patch?
