Michael Tokarev 8e8cb3b572 hw/display/qxl-render: fix qxl_unpack_chunks() chunk size calculation ...

In case of multiple chunks, code in qxl_unpack_chunks() takes size of the
wrong (next in the chain) chunk, instead of using current chunk size.
This leads to wrong number of bytes being copied, and to crashes if next
chunk size is larger than the current one.

Based on the code by Gao Yong.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1628
Tested-by: Thaddeus Hogan <thaddeus@thogan.com>
Tested-by: Vadim Zeitlin <vadim@wxwidgets.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250221134856.478806-1-mjt@tls.msk.ru>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

2025-07-29 13:56:39 +02:00

..

acpi-vga-stub.c

acpi: pc: vga: use AcpiDevAmlIf interface to build VGA device descriptors

2022-11-07 14:00:29 -05:00

acpi-vga.c

acpi: pc: vga: use AcpiDevAmlIf interface to build VGA device descriptors

2022-11-07 14:00:29 -05:00

apple-gfx-mmio.m

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

apple-gfx-pci.m

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

apple-gfx.h

include/system: Move exec/memory.h to system/memory.h

2025-04-23 14:08:21 -07:00

apple-gfx.m

hw/display/apple-gfx: Replace QemuSemaphore with QemuEvent

2025-06-06 14:32:55 +02:00

artist.c

qemu: Declare all load/store helper in 'qemu/bswap.h'

2025-07-15 02:56:39 -04:00

ati_2d.c

hw/display/ati: allow compiling without PIXMAN

2023-11-07 14:04:25 +04:00

ati_dbg.c

ati-vga: Add 30 bit palette access register

2023-11-06 15:58:43 +04:00

ati_int.h

ati-vga: Implement fallback for pixman routines

2023-11-06 15:58:45 +04:00

ati_regs.h

ati-vga: Add 30 bit palette access register

2023-11-06 15:58:43 +04:00

ati.c

qemu: Declare all load/store helper in 'qemu/bswap.h'

2025-07-15 02:56:39 -04:00

bcm2835_fb.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

bochs-display.c

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

cg3.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

cirrus_vga_internal.h

…

cirrus_vga_isa.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

cirrus_vga_rop2.h

…

cirrus_vga_rop.h

…

cirrus_vga.c

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

dm163.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

dpcd.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

edid-generate.c

…

edid-region.c

include/system: Move exec/memory.h to system/memory.h

2025-04-23 14:08:21 -07:00

exynos4210_fimd.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

framebuffer.c

…

framebuffer.h

include/system: Move exec/memory.h to system/memory.h

2025-04-23 14:08:21 -07:00

g364fb.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

i2c-ddc.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

jazz_led.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

Kconfig

pvg: do not enable it on cross-architecture targets

2025-02-25 16:18:11 +01:00

macfb.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

meson.build

pvg: add option to configure it out

2025-02-25 16:18:12 +01:00

next-fb.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

omap_lcdc.c

hw/arm/omap: Drop useless casts from void * to pointer

2023-01-12 17:15:09 +00:00

pl110_template.h

…

pl110.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

qxl-logger.c

hw/display/qxl: Pass requested buffer size to qxl_phys2virt()

2022-11-29 18:15:26 -05:00

qxl-render.c

hw/display/qxl-render: fix qxl_unpack_chunks() chunk size calculation

2025-07-29 13:56:39 +02:00

qxl.c

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

qxl.h

Replace "iothread lock" with "BQL" in comments

2024-01-08 10:45:43 -05:00

ramfb-standalone.c

hw/i386: Add the ramfb romfile compatibility

2025-07-18 21:41:57 +02:00

ramfb-stubs.c

ramfb: Add property to control if load the romfile

2025-07-17 12:44:57 +02:00

ramfb.c

ramfb: Add property to control if load the romfile

2025-07-17 12:44:57 +02:00

sii9022.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

sm501.c

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

ssd0303.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

ssd0323.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

tcx.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

trace-events

hw/display/apple-gfx: Adds configurable mode list

2024-12-31 21:21:34 +01:00

trace.h

…

vga_int.h

include/system: Move exec/ioport.h to system/ioport.h

2025-04-23 14:08:21 -07:00

vga_regs.h

vga: sort-of implement word and double-word access modes

2024-01-18 10:43:14 +01:00

vga-access.h

…

vga-helpers.h

vga: optimize horizontal pel panning in 256-color modes

2024-01-18 10:43:14 +01:00

vga-isa.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

vga-mmio.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

vga-pci.c

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

vga.c

qemu: Convert target_words_bigendian() to TargetInfo API

2025-07-15 02:56:39 -04:00

vhost-user-gpu-pci.c

modules: introduces module_kconfig directive

2022-06-06 09:26:53 +02:00

vhost-user-gpu.c

vhost-user: return failure if backend crash when live migration

2025-05-14 05:39:15 -04:00

vhost-user-vga.c

modules: introduces module_kconfig directive

2022-06-06 09:26:53 +02:00

virtio-dmabuf.c

hw/display: fix memleak from virtio_add_resource

2023-10-22 05:18:16 -04:00

virtio-gpu-base.c

hw/display: Allow injection of virtio-gpu EDID name

2025-07-15 10:22:33 +04:00

virtio-gpu-gl.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

virtio-gpu-pci-gl.c

modules: introduces module_kconfig directive

2022-06-06 09:26:53 +02:00

virtio-gpu-pci-rutabaga.c

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

virtio-gpu-pci.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

virtio-gpu-rutabaga.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

virtio-gpu-udmabuf-stubs.c

…

virtio-gpu-udmabuf.c

ui/egl: use DRM_FORMAT_MOD_INVALID as default modifier

2025-05-06 11:57:38 +04:00

virtio-gpu-virgl.c

virtio-gpu: support context init multiple timeline

2025-07-02 10:10:07 +01:00

virtio-gpu.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

virtio-vga-gl.c

modules: introduces module_kconfig directive

2022-06-06 09:26:53 +02:00

virtio-vga-rutabaga.c

gfxstream + rutabaga: add initial support for gfxstream

2023-10-16 11:29:56 +04:00

virtio-vga.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

virtio-vga.h

hw/display/virtio-vga: Convert TYPE_VIRTIO_VGA_BASE to 3-phase reset

2022-12-16 15:59:07 +00:00

vmware_vga.c

hw/display/vmware_vga: skip automatic zero-init of large struct

2025-06-12 13:40:15 -04:00

xenfb.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

xlnx_dp.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00