uefi-ref/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu.git synced 2026-08-26 22:23:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
qemu/ui
History
Marc-André Lureau 6075444c5a ui/vnc: validate SetPixelFormat field ranges 
The VNC SetPixelFormat message carries red/green/blue_max as 16-bit
values, but PixelFormat stores them as uint8_t. A client sending a
max value above 255 (e.g. 0x0100) passes the existing non-zero check
but silently truncates to 0 on assignment, leading to a division by
zero in the Tight PNG palette path.

Add explicit range checks if any channel max exceeds UINT8_MAX.

Fixes: CVE-2026-15578
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3976
Reported-by: dong ling
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
2026-07-17 15:52:31 +04:00
..
icons ui/icons/qemu.svg: Add metadata information (author, license) to the logo 2025-09-30 11:21:55 +04:00
shader meson: do not build shaders by default 2023-10-17 15:20:53 +02:00
clipboard.c ui/clipboard: clear deferred serial reset flag on resume 2026-04-22 12:46:04 +04:00
cocoa.m ui/cocoa: implement display cleanup 2026-06-24 15:41:15 +04:00
console-gl.c ui/surface: Avoid including epoxy/gl.h in header files 2026-03-17 21:15:10 +04:00
console-priv.h ui/console-vc: move VT100 emulation into separate unit 2026-05-09 10:24:48 +04:00
console-vc-stubs.c ui/console-vc: move VT100 emulation into separate unit 2026-05-09 10:24:48 +04:00
console-vc.c ui/console-vc: fire ADDED/REMOVED notifications 2026-06-24 15:41:15 +04:00
console.c ui/console: unregister console from QOM tree on close 2026-06-24 15:41:15 +04:00
cp437.c ui/console-vc: add UTF-8 input decoding with CP437 rendering 2026-05-09 10:24:37 +04:00
cp437.h ui/console-vc: add UTF-8 input decoding with CP437 rendering 2026-05-09 10:24:37 +04:00
curses.c ui/curses: implement display cleanup 2026-06-24 15:41:15 +04:00
curses_keys.h For curses display, recognize a few more control keys 2023-07-25 10:56:51 +01:00
cursor.c ui/cursor: remove cursor_get_mono_image 2024-10-03 17:26:06 +03:00
cursor_hidden.xpm
cursor_left_ptr.xpm
dbus-chardev.c ui/dbus: expose vc encoding via D-Bus Chardev.VCEncoding interface 2026-05-09 10:24:35 +04:00
dbus-clipboard.c io: use g_clear_handle_id() for GSource cleanup 2026-05-06 16:10:46 +02:00
dbus-console.c ui/dbus: handle console hotplug/unplug events 2026-06-24 15:41:15 +04:00
dbus-display1.xml ui/dbus: expose vc encoding via D-Bus Chardev.VCEncoding interface 2026-05-09 10:24:35 +04:00
dbus-error.c ui: add a D-Bus display backend 2021-12-21 10:50:22 +04:00
dbus-listener.c ui/console: rename public API to use consistent qemu_console_ prefix 2026-05-09 18:54:15 +04:00
dbus-module.c ui/dbus: add p2p=on/off option 2021-12-21 10:50:22 +04:00
dbus.c ui/dbus: handle console hotplug/unplug events 2026-06-24 15:41:15 +04:00
dbus.h ui/dbus: handle console hotplug/unplug events 2026-06-24 15:41:15 +04:00
display-surface.c ui: move DisplaySurface functions to display-surface.c 2026-04-28 18:39:36 +04:00
dmabuf.c ui/dmabuf: extend QemuDmaBuf to support multi-plane 2025-05-06 11:57:03 +04:00
egl-context.c ui/egl: Don't change bound GL context when creating new context 2026-03-06 17:27:40 +00:00
egl-headless.c ui/egl: implement display and EGL cleanup 2026-06-24 15:41:15 +04:00
egl-helpers.c ui/egl: implement display and EGL cleanup 2026-06-24 15:41:15 +04:00
gtk-clipboard.c ui/gtk: implement display cleanup 2026-06-24 15:41:15 +04:00
gtk-egl.c ui/gtk: Narrow DMA-BUF critical section 2026-07-17 15:52:31 +04:00
gtk-gl-area.c ui/gtk: Narrow DMA-BUF critical section 2026-07-17 15:52:31 +04:00
gtk.c ui/gtk: handle console hotplug/unplug events 2026-06-24 15:41:15 +04:00
input-barrier.c ui/input-barrier: fix off-by-one in keycode bounds check 2026-07-17 15:52:31 +04:00
input-barrier.h ui: add an embedded Barrier client 2019-09-17 13:43:22 +02:00
input-keymap.c ui/input: Remove unused QKeyCode helpers and keymaps 2026-05-25 02:01:35 +04:00
input-linux.c ui/input-linux: Use Linux key codes 2026-05-25 02:01:34 +04:00
input.c ui/input: Have qemu_input_is_absolute() take a const QemuConsole 2026-06-17 19:22:50 +04:00
kbd-state.c ui/kbd-state: Use Linux key codes 2026-05-25 01:00:54 +04:00
keymaps.c ui/keymaps: Use Linux key codes 2026-05-25 02:01:35 +04:00
keymaps.h ui: rename init_keyboard_layout->kbd_layout_new() 2026-04-28 18:39:36 +04:00
meson.build ui/spice: add cleanup on shutdown 2026-06-24 15:41:14 +04:00
qemu-pixman.c ui/pixman: fix zero rowstride in qemu_pixman_image_new_shareable() 2026-06-17 19:22:50 +04:00
qemu-x509.h
qemu.desktop ui: fix icon display for GTK frontend under GNOME Shell with Wayland 2019-01-21 09:43:13 +01:00
sdl2-2d.c ui/console: rename public API to use consistent qemu_console_ prefix 2026-05-09 18:54:15 +04:00
sdl2-gl.c ui/console: rename public API to use consistent qemu_console_ prefix 2026-05-09 18:54:15 +04:00
sdl2-input.c ui/sdl2: Use Linux key codes 2026-05-25 02:01:35 +04:00
sdl2.c ui/sdl2: implement display cleanup 2026-06-24 15:41:15 +04:00
shader.c ui/surface: Avoid including epoxy/gl.h in header files 2026-03-17 21:15:10 +04:00
spice-app.c ui/spice-app: implement display cleanup 2026-06-24 15:41:15 +04:00
spice-core.c ui/spice: add cleanup on shutdown 2026-06-24 15:41:14 +04:00
spice-display.c ui/spice: add cleanup on shutdown 2026-06-24 15:41:14 +04:00
spice-input.c ui/spice: add cleanup on shutdown 2026-06-24 15:41:14 +04:00
spice-module.c ui/spice: add cleanup on shutdown 2026-06-24 15:41:14 +04:00
trace-events ui/sdl2: Use Linux key codes 2026-05-25 02:01:35 +04:00
trace.h trace: switch position of headers to what Meson requires 2020-08-21 06:18:24 -04:00
udmabuf.c Do not include "qemu/error-report.h" in headers that do not need it 2023-02-14 09:11:27 +01:00
ui-hmp-cmds.c monitor: replace 'common' with 'parent_obj' in MonitorHMP 2026-07-07 11:16:22 +02:00
ui-qmp-cmds.c ui/qmp: keep a reference of console across yield 2026-06-24 15:41:14 +04:00
util.c include/hw/pci: Split pci_device.h off pci.h 2023-01-08 01:54:22 -05:00
vdagent.c ui/vdagent: Use VMSTATE_GBYTEARRAY to safely migrate outbuf 2026-06-01 19:32:49 +00:00
vgafont.c ui/vgafont: add SPDX license header 2026-04-22 12:51:23 +04:00
vgafont.h ui: move FONT_WIDTH/HEIGHT to vgafont.h 2026-04-28 18:39:36 +04:00
vnc-auth-sasl.c ui/vnc: fix OOB read access in VNC SASL mechname array 2026-05-25 01:00:53 +04:00
vnc-auth-sasl.h vnc: avoid deprecation warnings for SASL on OS X 2021-06-15 17:17:09 +02:00
vnc-auth-vencrypt.c io: use g_clear_handle_id() for GSource cleanup 2026-05-06 16:10:46 +02:00
vnc-auth-vencrypt.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
vnc-clipboard.c ui: fix validation of VNC extended clipboard data length 2026-05-25 01:00:54 +04:00
vnc-enc-hextile-template.h ui/vnc-enc-hextile: Use static rather than dynamic length stack array 2023-09-04 14:57:44 +04:00
vnc-enc-hextile.c Drop useless casts from g_malloc() & friends to pointer 2022-10-22 23:15:40 +02:00
vnc-enc-tight.c ui/vnc: replace VNC_DEBUG with trace-events 2026-05-09 18:54:15 +04:00
vnc-enc-tight.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
vnc-enc-zlib.c ui/vnc: replace VNC_DEBUG with trace-events 2026-05-09 18:54:15 +04:00
vnc-enc-zrle.c ui/vnc: Introduce the VncWorker type 2025-07-14 14:51:12 +04:00
vnc-enc-zrle.c.inc ui/vnc: Introduce the VncWorker type 2025-07-14 14:51:12 +04:00
vnc-enc-zrle.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
vnc-enc-zywrle-template.c ui: fix tab indentation 2022-11-08 10:23:06 +01:00
vnc-enc-zywrle.h ui: spelling fixes 2023-08-31 19:47:43 +02:00
vnc-jobs.c ui/vnc: make the worker thread per-VncDisplay 2026-05-09 10:24:50 +04:00
vnc-jobs.h ui/vnc: make the worker thread per-VncDisplay 2026-05-09 10:24:50 +04:00
vnc-palette.c ui: Clean up local variable shadowing 2023-09-29 08:13:57 +02:00
vnc-palette.h Include qapi/qmp/qlist.h exactly where needed 2018-02-09 13:52:15 +01:00
vnc-stubs.c ui: add proper error reporting for password changes 2026-03-05 17:40:24 +00:00
vnc-system.c ui/vnc: add vnc-system unit, to allow different implementations 2026-05-09 10:24:58 +04:00
vnc-ws.c ui/vnc: replace VNC_DEBUG with trace-events 2026-05-09 18:54:15 +04:00
vnc-ws.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
vnc.c ui/vnc: validate SetPixelFormat field ranges 2026-07-17 15:52:31 +04:00
vnc.h ui/vnc: switch LED handling to Notifier-based input API 2026-06-17 19:22:50 +04:00
vnc_keysym.h ui: fix tab indentation 2022-11-08 10:23:06 +01:00
vt100.c ui/vt100: add vt100_fini() check 2026-05-25 01:00:53 +04:00
vt100.h ui/console-vc: move VT100 emulation into separate unit 2026-05-09 10:24:48 +04:00
win32-kbd-hook.c include: Rename sysemu/ -> system/ 2024-12-20 17:44:56 +01:00
x_keymap.c ui/gtk: Use Linux key codes 2026-05-25 02:01:34 +04:00
x_keymap.h ui/gtk: Use Linux key codes 2026-05-25 02:01:34 +04:00