)]}'
{
  "commit": "24767bcf0fdcd19415cb07c06f637ea29a5cebbb",
  "tree": "d76fcfc4bc09ae163559e9341bfe1c667e5dd46c",
  "parents": [
    "8cfd68c4b235e8b1c50f47c6eff364cc60b058d8"
  ],
  "author": {
    "name": "Marc-André Lureau",
    "email": "marcandre.lureau@redhat.com",
    "time": "Thu Jul 09 17:42:25 2026 +0400"
  },
  "committer": {
    "name": "Michael Tokarev",
    "email": "mjt@tls.msk.ru",
    "time": "Tue Jul 21 00:02:25 2026 +0300"
  },
  "message": "ui/vnc: fix out-of-bounds write in lossy refresh dirty marking\n\nvnc_refresh_lossy_rect() marks a full VNC_STAT_RECT (64) rows of the\ndirty bitmap when refreshing a lossy tile. When the display height is\nnot a multiple of VNC_STAT_RECT, the last tile row is a partial tile and\nthe loop writes past the end of vs-\u003edirty[VNC_MAX_HEIGHT].\n\nFor example, with a 2160-pixel-high display (VNC_MAX_HEIGHT), the last\nstat tile starts at y\u003d2112. The unconditional 64-row loop writes rows\n2112..2175, overflowing 16 rows (640 bytes) past the dirty bitmap into\nsubsequent VncState fields.\n\nFix by passing the effective display height into\nvnc_refresh_lossy_rect() and clamping the inner loop.\n\nFixes: CVE-2026-61475\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3935\nReported-by: \"Vulnerability Report\" \u003cvr@darknavy.com\u003e\nReviewed-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\nSigned-off-by: Marc-Andre Lureau \u003cmarcandre.lureau@redhat.com\u003e\n(cherry picked from commit e650e4fe0fb35b7a8ec9fc04e00346c02640bd58)\nSigned-off-by: Michael Tokarev \u003cmjt@tls.msk.ru\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d2ae127f0bf165ea1dd35e139025d9c2e83f1ec4",
      "old_mode": 33188,
      "old_path": "ui/vnc.c",
      "new_id": "16cd3eac2a666b2e27dcf32fd49cc7e2ca2a1d4a",
      "new_mode": 33188,
      "new_path": "ui/vnc.c"
    }
  ]
}