Merge tag 'fix-pr-v1' of https://gitlab.com/marcandre.lureau/qemu into staging

Various UI/security-related fixes for 11.1 To: qemu-devel@nongnu.org Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmpaF38ACgkQ2ujhCXWW # nOWJLQ//Qo05CJVgpZyhYb2xCgWGBXZ5DmNIB6FidL3ZF7OHavpuGfT0c35TA6Iy # wh8U7x44FFsvc0N1T52es13sEX6ff8KSGRL356fVq1O5KdbLUg9NxQ7DFHBAQFkA # rk/A/tj1+4F/T2snukpSr/M8XDL9nLtCC4vVasFysce6TdGFiRrYYoYSMoV7sPMD # meBTLqHUXMoqCW84K0bX5CZWii3j//ZkoRDoSn3n61QrUAw3hQEc4jB8heHY2MW4 # i1sIYHbfoO5l75mZPfm34aSs889ooEfw0MVMYb4BqMXdFxwm8UuvyMrCv5sT/SKJ # XsfSgtdCYODrlkDscGW9X774QtejuIsEsKp73ZANBj7U4W/JysAc55Ej9doaY8SO # teLiR0/0tJD0+z7K4z5Euqzv0DXUPM/LTWAkoa77JyUPWIuzRUftbEAtvLQEYhCf # S08SILBUcMytD6tBGOXw5tO+MLL313hGjfWB/KxKQM9GtxzK22+wMHOiry91WcD2 # duPuExN21irqsNtBoJ5EHE5EluUIFZjqEILNqtwPoiUU4sn1tPDUeXXzv1AXtln/ # y0JGp7zg1y+wMswkBEES8nrSQhWHNkY9nWOseY/N2LzPs7CyZmgI1ZIU8aW3U20g # jg77LHTXTfwJyHChGo3SiYpm++x4GDrt+WOi8o4SpcTzLW0+KIA= # =uFU3 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 17 Jul 2026 07:52:31 EDT # gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5 # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full] # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full] # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * tag 'fix-pr-v1' of https://gitlab.com/marcandre.lureau/qemu: hw/display/virtio-gpu: Check pixman_image_create_bits() results hw/display/virtio-gpu: reject strides exceeding INT_MAX hw/display/virtio-gpu: handle migration iov allocation failure hw/display/virtio-gpu: cap submit_3d command buffer allocation hw/display/virtio-gpu: validate stride against width on scanout hw/display/qxl: fix TOCTOU in cursor chunk data_size handling hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure ui/vnc: validate SetPixelFormat field ranges ui/vnc: fix out-of-bounds write in lossy refresh dirty marking ui/gtk: Narrow DMA-BUF critical section ui/input-barrier: fix off-by-one in keycode bounds check ui/vnc: use RFB wire types for client message handlers ui/vnc: validate color shifts in SetPixelFormat ui/vnc: fix OOB write in vnc_refresh_lossy_rect i386/tdx: fix uninitialized variable warning in tdx_check_features Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>