diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2026-07-13 13:24:03 +0400 |
|---|---|---|
| committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2026-07-17 15:52:31 +0400 |
| commit | 6075444c5a72ab531295d92050d95cebea8a8119 (patch) | |
| tree | 47a578736132cae2c58d7567726d008acbd25c9c /ui | |
| parent | e650e4fe0fb35b7a8ec9fc04e00346c02640bd58 (diff) | |
| download | qemu-6075444c5a72ab531295d92050d95cebea8a8119.tar.gz qemu-6075444c5a72ab531295d92050d95cebea8a8119.zip | |
ui/vnc: validate SetPixelFormat field ranges
The VNC SetPixelFormat message carries red/green/blue_max as 16-bit
values, but PixelFormat stores them as uint8_t. A client sending a
max value above 255 (e.g. 0x0100) passes the existing non-zero check
but silently truncates to 0 on assignment, leading to a division by
zero in the Tight PNG palette path.
Add explicit range checks if any channel max exceeds UINT8_MAX.
Fixes: CVE-2026-15578
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3976
Reported-by: dong ling
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
Diffstat (limited to 'ui')
| -rw-r--r-- | ui/vnc.c | 5 |
1 files changed, 5 insertions, 0 deletions
@@ -2271,6 +2271,11 @@ static void set_pixel_format(VncState *vs, uint8_t bits_per_pixel, return; } + if (red_max > UINT8_MAX || green_max > UINT8_MAX || blue_max > UINT8_MAX) { + vnc_client_error(vs); + return; + } + if (red_shift >= bits_per_pixel || red_shift >= 32 || green_shift >= bits_per_pixel || green_shift >= 32 || blue_shift >= bits_per_pixel || blue_shift >= 32) { |