ui/vnc: fix OOB read updating VNC update frequency stats
Incorrect loop bounds in vnc_update_freq result in iterating past the last row and past the last column in the VNC stats array. With suitably chosen dimensions this could be a OOB read that accesses memory beyond the VncDisplay struct that the stats array is embedded in. Should this hit a guard page, it could trigger a guest crash. If it does not, then the VNC frequency stats will be updated with garbage. Fixes: CVE-2026-48003 Reported-by: boy juju <agx1657748706@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20260521103353.1645561-5-berrange@redhat.com>
Daniel P. Berrangé committed
May 21, 2026 at 11:33 UTC
d0c7b82d3a89dd9c863f8aa69b07360c648ca9fb
1 file changed
+4
-2
ui/vnc.c
+4
-2
@@ -3093,12 +3093,14 @@ double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
3093
int i, j;
3094
double total = 0;
3095
int num = 0;
3096
+ int x_end = x + w;
3097
+ int y_end = y + h;
3098
3099
x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
3100
y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
3101
3100
- for (j = y; j <= y + h; j += VNC_STAT_RECT) {
3101
- for (i = x; i <= x + w; i += VNC_STAT_RECT) {
3102
+ for (j = y; j < y_end; j += VNC_STAT_RECT) {
3103
+ for (i = x; i < x_end; i += VNC_STAT_RECT) {
3104
total += vnc_stat_rect(vs->vd, i, j)->freq;
3105
num++;
3106
}