ui/vnc: fix OOB write in lossy rect worker code
Incorrect calculation of the boundary condition when tracking lossy rectangles in the worker thread will result in an OOB write which can corrupt further worker state, and/or trigger any guard pages that may lie beyond the VncWorker struct. This can be triggered through careful choice of the display resolution in the guest OS by an unprivileged user. Fixes: CVE-2026-48002 Reported-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20260521103353.1645561-4-berrange@redhat.com> [Marc-André - added assert() suggest by philmd@linaro.org] Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Daniel P. Berrangé committed
May 21, 2026 at 11:33 UTC
46ee49034d26d04d95ba8f3183d4fbfa9d2b89b4
1 file changed
+6
-4
ui/vnc.c
+6
-4
@@ -2982,13 +2982,15 @@ void vnc_sent_lossy_rect(VncWorker *worker, int x, int y, int w, int h)
2982
{
2983
int i, j;
2984
2985
- w = (x + w) / VNC_STAT_RECT;
2986
- h = (y + h) / VNC_STAT_RECT;
2985
+ w = DIV_ROUND_UP((x + w), VNC_STAT_RECT);
2986
+ h = DIV_ROUND_UP((y + h), VNC_STAT_RECT);
2987
+ assert(h <= VNC_STAT_ROWS);
2988
+ assert(w <= VNC_STAT_COLS);
2989
x /= VNC_STAT_RECT;
2990
y /= VNC_STAT_RECT;
2991
2990
- for (j = y; j <= h; j++) {
2991
- for (i = x; i <= w; i++) {
2992
+ for (j = y; j < h; j++) {
2993
+ for (i = x; i < w; i++) {
2994
worker->lossy_rect[j][i] = 1;
2995
}
2996
}