ui/vnc: validate SetPixelFormat field ranges
The VNC SetPixelFormat message carries red/green/blue_max as 16-bit values, but PixelFormat stores them as uint8_t. A client sending a max value above 255 (e.g. 0x0100) passes the existing non-zero check but silently truncates to 0 on assignment, leading to a division by zero in the Tight PNG palette path. Add explicit range checks if any channel max exceeds UINT8_MAX. Fixes: CVE-2026-15578 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3976 Reported-by: dong ling Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
Marc-André Lureau committed
Jul 13, 2026 at 13:24 UTC
6075444c5a72ab531295d92050d95cebea8a8119
1 file changed
+5
ui/vnc.c
+5
@@ -2271,6 +2271,11 @@ static void set_pixel_format(VncState *vs, uint8_t bits_per_pixel,
2271
return;
2272
}
2273
2274
+ if (red_max > UINT8_MAX || green_max > UINT8_MAX || blue_max > UINT8_MAX) {
2275
+ vnc_client_error(vs);
2276
+ return;
2277
+ }
2278
+
2279
if (red_shift >= bits_per_pixel || red_shift >= 32 ||
2280
green_shift >= bits_per_pixel || green_shift >= 32 ||
2281
blue_shift >= bits_per_pixel || blue_shift >= 32) {