Commit bd9a2e5974 for qemu.org
commit bd9a2e5974afbd96fb365e12bf34318834be43ab
Merge: 43bf3a0ce9 f1af81ba2a
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: Sat Jul 18 19:16:51 2026 -0400
Merge tag 'fix-pr-v1' of https://gitlab.com/marcandre.lureau/qemu into staging
Various UI/security-related fixes for 11.1
To: qemu-devel@nongnu.org
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmpaF38ACgkQ2ujhCXWW
# nOWJLQ//Qo05CJVgpZyhYb2xCgWGBXZ5DmNIB6FidL3ZF7OHavpuGfT0c35TA6Iy
# wh8U7x44FFsvc0N1T52es13sEX6ff8KSGRL356fVq1O5KdbLUg9NxQ7DFHBAQFkA
# rk/A/tj1+4F/T2snukpSr/M8XDL9nLtCC4vVasFysce6TdGFiRrYYoYSMoV7sPMD
# meBTLqHUXMoqCW84K0bX5CZWii3j//ZkoRDoSn3n61QrUAw3hQEc4jB8heHY2MW4
# i1sIYHbfoO5l75mZPfm34aSs889ooEfw0MVMYb4BqMXdFxwm8UuvyMrCv5sT/SKJ
# XsfSgtdCYODrlkDscGW9X774QtejuIsEsKp73ZANBj7U4W/JysAc55Ej9doaY8SO
# teLiR0/0tJD0+z7K4z5Euqzv0DXUPM/LTWAkoa77JyUPWIuzRUftbEAtvLQEYhCf
# S08SILBUcMytD6tBGOXw5tO+MLL313hGjfWB/KxKQM9GtxzK22+wMHOiry91WcD2
# duPuExN21irqsNtBoJ5EHE5EluUIFZjqEILNqtwPoiUU4sn1tPDUeXXzv1AXtln/
# y0JGp7zg1y+wMswkBEES8nrSQhWHNkY9nWOseY/N2LzPs7CyZmgI1ZIU8aW3U20g
# jg77LHTXTfwJyHChGo3SiYpm++x4GDrt+WOi8o4SpcTzLW0+KIA=
# =uFU3
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 17 Jul 2026 07:52:31 EDT
# gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5
* tag 'fix-pr-v1' of https://gitlab.com/marcandre.lureau/qemu:
hw/display/virtio-gpu: Check pixman_image_create_bits() results
hw/display/virtio-gpu: reject strides exceeding INT_MAX
hw/display/virtio-gpu: handle migration iov allocation failure
hw/display/virtio-gpu: cap submit_3d command buffer allocation
hw/display/virtio-gpu: validate stride against width on scanout
hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
ui/vnc: validate SetPixelFormat field ranges
ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
ui/gtk: Narrow DMA-BUF critical section
ui/input-barrier: fix off-by-one in keycode bounds check
ui/vnc: use RFB wire types for client message handlers
ui/vnc: validate color shifts in SetPixelFormat
ui/vnc: fix OOB write in vnc_refresh_lossy_rect
i386/tdx: fix uninitialized variable warning in tdx_check_features
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>