)]}'
{
  "commit": "a3cc0069e151e5eb5db57bb4e86b00861d5b97ab",
  "tree": "39fbbe423a4405b47808815269a526a67624dc36",
  "parents": [
    "ecc569639aeb5b702f1098d3eb5b28d3168604c8"
  ],
  "author": {
    "name": "Marc-André Lureau",
    "email": "marcandre.lureau@redhat.com",
    "time": "Fri Jul 10 17:43:52 2026 +0400"
  },
  "committer": {
    "name": "Philippe Mathieu-Daudé",
    "email": "philmd@oss.qualcomm.com",
    "time": "Wed Jul 15 15:50:22 2026 +0200"
  },
  "message": "hw/display/qxl: fix TOCTOU in cursor chunk data_size handling\n\nSnapshot chunk.data_size into a host-local variable before passing it to\nqxl_phys2virt() for validation, and pass it through qxl_cursor() and\nqxl_unpack_chunks() so that no subsequent code re-reads the field.\n\nWithout this, a racing vCPU can inflate data_size between the\nqxl_phys2virt() validation and the memcpy in qxl_unpack_chunks(),\ncausing a source read past the validated region. In practice the read\nstays within the guest\u0027s own VRAM mmap, so the impact is limited.\n\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3757\nReported-by: Feifan Qian \u003cbea1e@proton.me\u003e\nSigned-off-by: Marc-Andre Lureau \u003cmarcandre.lureau@redhat.com\u003e\nReviewed-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\nMessage-ID: \u003c20260710134352.2313675-1-marcandre.lureau@redhat.com\u003e\nSigned-off-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3bf634ee0591667191ebe3912848ea99c8180e7f",
      "old_mode": 33188,
      "old_path": "hw/display/qxl-render.c",
      "new_id": "4799c9e8befda328801a165891efdf908f31b97c",
      "new_mode": 33188,
      "new_path": "hw/display/qxl-render.c"
    }
  ]
}