On 28/11/22 16:41, Philippe Mathieu-Daudé wrote:
On 28/11/22 16:08, Gerd Hoffmann wrote:
Also at least one code path (processing SPICE_CURSOR_TYPE_MONO in qxl_cursor) goes access chunk.data[] without calling qxl_unpack_chunks(), that needs additional verification too (or switch it to call qxl_unpack_chunks, or just drop it because nobody uses mono chrome cursors anyway).
Per commit 36ffc122dc ("qxl: support mono cursors with inverted colors") "Monochrome cursors are still used by Windows guests" (i.e. Win2008R2) :/