ui/vnc: validate color shifts in SetPixelFormat
A malicious VNC client can send a SetPixelFormat message with shift values >= 32, causing UB mask computation (e.g. red_max << red_shift where red_shift is 255). Apparently, this is not covered by -fwrapv. Reject color shifts >= bits_per_pixel || 32 before computing masks. Fixes: 9f64916da20 ("pixman/vnc: use pixman images in vnc.") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3948 Reported-by: huntr bubble Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
Marc-André Lureau committed
Jul 6, 2026 at 14:40 UTC
fb71c895d7ff3c68f228095b5e6494e6c23b6a0b
1 file changed
+7
ui/vnc.c
+7
@@ -2276,6 +2276,13 @@ static void set_pixel_format(VncState *vs, int bits_per_pixel,
2276
return;
2277
}
2278
2279
+ if (red_shift >= bits_per_pixel || red_shift >= 32 ||
2280
+ green_shift >= bits_per_pixel || green_shift >= 32 ||
2281
+ blue_shift >= bits_per_pixel || blue_shift >= 32) {
2282
+ vnc_client_error(vs);
2283
+ return;
2284
+ }
2285
+
2286
vs->client_pf.rmax = red_max ? red_max : 0xFF;
2287
vs->client_pf.rbits = ctpopl(red_max);
2288
vs->client_pf.rshift = red_shift;