hw/display/virtio-gpu: Check pixman_image_create_bits() results
pixman_image_create_bits() returns NULL for allocation failures and unaligned strides, which may be supplied by the guest with VIRTIO_GPU_CMD_SET_SCANOUT_BLOB, and virtio_gpu_do_set_scanout() subsequently dereferences it. Fixes: fa06e5cb7b10 ("virtio-gpu: fix scanout rectangles") Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20260717-pixman-v1-1-89ea33b50b75@rsg.ci.i.u-tokyo.ac.jp>
Akihiko Odaki committed
Jul 17, 2026 at 16:05 UTC
f1af81ba2aeec7b5a5ee8529ef55275865aea0c0
1 file changed
+4
hw/display/virtio-gpu.c
+4
@@ -690,6 +690,10 @@ static bool virtio_gpu_do_set_scanout(VirtIOGPU *g,
690
void *ptr = data + fb->offset;
691
rect = pixman_image_create_bits(fb->format, r->width, r->height,
692
ptr, fb->stride);
693
+ if (!rect) {
694
+ *error = VIRTIO_GPU_RESP_ERR_UNSPEC;
695
+ return false;
696
+ }
697
698
if (res->image) {
699
pixman_image_ref(res->image);