@samitouri / QOSamiQemu / commits / 0e51b71c7b

hw/display/qxl: Fix mono cursor validation that can read past a cursor chunk

qxl_render_cursor() maps the guest-provided QXLCursor object using the guest-controlled cursor->chunk.data_size. For a mono cursor, qxl_cursor() then validates the expected bitmap size against cursor->data_size, but it does not validate that the first chunk actually contains that many bytes. A guest could set cursor->data_size to the correct full mono cursor size while setting cursor->chunk.data_size to zero. In that case, cursor_set_mono() reads the AND/XOR masks starting at cursor->chunk.data. If the cursor object is placed at the end of the QXL RAM BAR, those reads cross the mapped RAM region and could crash the QEMU process (e.g. under ASan). Fix it by double-checking cursor->chunk.data_size for the correct size. This patch is based on the suggested changes by the reporter in the bug ticket. Reported-by: huntr bubble Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3646 Signed-off-by: Thomas Huth <thuth@redhat.com> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20260630101022.379057-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Thomas Huth committed Jun 30, 2026 at 12:10 UTC 0e51b71c7b7706923536c1f7923cace82877932b

1 file changed +5 -3

hw/display/qxl-render.c

+5 -3

@@ -272,9 +272,11 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,

272 case SPICE_CURSOR_TYPE_MONO:

273 /* Assume that the full cursor is available in a single chunk. */

274 size = 2 * cursor_get_mono_bpl(c) * c->height;

275 - if (size != cursor->data_size) {

276 - fprintf(stderr, "%s: bad monochrome cursor %ux%u with size %u\n",

277 - __func__, c->width, c->height, cursor->data_size);

275 + if (size != cursor->data_size || cursor->chunk.data_size < size) {

276 + qxl_set_guest_bug(qxl, "%s: bad monochrome cursor %ux%u"

277 + " data_size %u chunk_size %u",

278 + __func__, c->width, c->height,

279 + cursor->data_size, cursor->chunk.data_size);

280 goto fail;

281 }

282 and_mask = cursor->chunk.data;