Hi This series addresses a collection of bugs reported by Pavee Hui at https://gitlab.com/qemu-project/qemu/-/work_items/4560, most likley with AI assitance. None of them should deserve a confidential level, imho.
I reviewed each reported issue against the code, and wrote individual fixes, using Claude as a review assistant. Several reported issues were dropped after review as incorrect or already addressed upstream. The remaining fixes were split into bisectable commits. Signed-off-by: Marc-André Lureau <[email protected]> --- Marc-André Lureau (63): audio/ossaudio: fix ioctl passing address-of-pointer instead of pointer audio/dbusaudio: fix off-by-one in volume channel assertion audio/ossaudio: fix off-by-one in mmap buffer size assertion audio/paaudio: fix server string in PAConnection audio/paaudio: avoid pidfile path truncation audio/pwaudio: fix capture buffer leak on early return paths audio/pwaudio: clamp overrun writes to remaining ring buffer space audio/pwaudio: fix integer underflow in qpw_read() audio/pwaudio: handle negative avail in qpw_write and qpw_buffer_get_free audio/pwaudio: bail out on underrun in qpw_write audio/audio-mixeng-be: add upper bounds to audio settings validation audio/wavcapture: prevent freq overflow and corrupted WAV header ui/clipboard: clean up vm change state handler on last peer unregister ui/console: skip empty update regions in qemu_console_update ui/console: use QLIST_FOREACH_SAFE in dpy_refresh ui/input: fix integer overflow in qemu_input_scale_axis ui/vnc-enc-zrle: propagate zrle_compress_data error ui/vnc-jobs: assert rect coordinates and dimensions in vnc_job_add_rect chardev/char-pty: free pty_name in finalize chardev/char-ringbuf: reject zero size with is_power_of_2 chardev/char-ringbuf: use actual read length in qmp_ringbuf_read chardev/char-udp: clarify read_poll return value with pending data chardev/char: fix use-after-free on mux creation failure hw/audio/gusemu_mixer: fix integer overflow in volume ramping hw/audio/gusemu_mixer: use unsigned literal for IRQ bit shifts hw/char/cadence_uart: fix RX FIFO overflow handling hw/char/cadence_uart: use correct interrupt for TX FIFO overflow hw/char/cadence_uart: validate FIFO indices in post_load hw/char/cadence_uart: fix post_load return value for invalid baud rate hw/char/escc: validate channel register index in post_load hw/char/exynos4210_uart: fix baud rate calculation operator precedence hw/char/exynos4210_uart: enforce 32-bit MMIO access size hw/char/ibex_uart: prevent division by zero on baud rate calculation hw/char/imx_serial: update interrupts after status register writes hw/char/serial: clamp zero baud rate to default hw/char/sh_serial: fix RDF flag clear on FIFO reset hw/char/sh_serial: use rx_cnt for available FIFO space hw/char/sh_serial: fix break detection flag hw/char/terminal3270: fix output buffer size for IAC-escaped header hw/char/terminal3270: consume processed input data hw/char/terminal3270: fix pre-handshake outbound data check hw/char/virtio-serial-bus: validate scatter-gather state in post_load hw/display/ramfb: validate guest-supplied stride hw/display/ramfb: fix map/unmap region size mismatch hw/display/ssd0323: mask SPI data to 8 bits hw/display/ssd0323: fix signed modulo in column/row commands hw/display/xenfb: fix 24-bit pixel read in BLT macro hw/input/adb: reject zero-length requests hw/input/adb: validate devaddr on migration load hw/input/adb: report error when too many devices are registered hw/input/adb-kbd: validate WRITEREG request buffer length hw/input/adb-kbd: validate ring buffer indices on migration load hw/input/adb-kbd: check for errors after parent realize hw/input/adb-kbd: guard parent_unrealize against NULL hw/input/adb-mouse: validate WRITEREG request buffer length hw/input/adb-mouse: check for errors after parent realize hw/input/adb-mouse: add unrealize handler to unregister input hw/input/hid: validate queue length and key count on migration load hw/input/hid: fix off-by-one in pointer queue access on migration load hw/input/pl050: remove duplicate class_init assignment hw/input/stellaris_gamepad: deassert IRQs on reset hw/input/virtio-input: free VirtQueueElement in error unwind path hw/input/virtio-input: document queue preservation on device reset audio/audio-mixeng-be.c | 4 ++-- audio/dbusaudio.c | 4 ++-- audio/ossaudio.c | 4 ++-- audio/paaudio.c | 6 ++++-- audio/pwaudio.c | 22 ++++++++++++++++++++-- audio/wavcapture.c | 6 ++++++ chardev/char-pty.c | 1 + chardev/char-ringbuf.c | 10 ++++++---- chardev/char-udp.c | 4 ++++ chardev/char.c | 1 + hw/audio/gusemu_mixer.c | 16 +++++++++------- hw/char/cadence_uart.c | 26 ++++++++++++++++---------- hw/char/escc.c | 11 +++++++++++ hw/char/exynos4210_uart.c | 6 +++++- hw/char/ibex_uart.c | 8 ++++++-- hw/char/imx_serial.c | 3 +++ hw/char/serial.c | 3 +++ hw/char/sh_serial.c | 6 +++--- hw/char/terminal3270.c | 15 ++++++--------- hw/char/virtio-serial-bus.c | 6 ++++++ hw/display/ramfb.c | 10 ++++++++-- hw/display/ssd0323.c | 9 +++++---- hw/display/xenfb.c | 19 +++++++++++++------ hw/input/adb-kbd.c | 29 ++++++++++++++++++++++++++++- hw/input/adb-mouse.c | 23 +++++++++++++++++++++++ hw/input/adb.c | 17 +++++++++++++++++ hw/input/hid.c | 9 ++++++++- hw/input/pl050.c | 1 - hw/input/stellaris_gamepad.c | 3 +++ hw/input/virtio-input.c | 5 +++++ ui/clipboard.c | 4 ++++ ui/console.c | 7 +++++-- ui/input.c | 8 +++++++- ui/vnc-enc-zrle.c | 19 ++++++++++++++----- ui/vnc-jobs.c | 1 + 35 files changed, 257 insertions(+), 69 deletions(-) --- base-commit: 2a0ac9c8ac2d303ca515dc819043409aef18cab5 change-id: 20261002-issue-4560-a704c9fc737f Best regards, -- Marc-André Lureau <[email protected]>
