All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Marc-André Lureau" <marcandre.lureau@redhat.com>
To: qemu-devel@nongnu.org
Subject: [GIT PULL 04/15] ui/vnc: use RFB wire types for client message handlers
Date: Fri, 17 Jul 2026 15:52:43 +0400	[thread overview]
Message-ID: <20260717-fix-v1-4-cb9f7d49dc52@redhat.com> (raw)
In-Reply-To: <20260717-fix-v1-0-cb9f7d49dc52@redhat.com>

Use exact-width unsigned types for the static functions that process
RFB client messages, matching the types returned by read_u8(),
read_u16(), and read_u32():

 - set_pixel_format: uint8_t/uint16_t for pixel format fields
 - pointer_event: uint8_t button_mask, uint16_t x/y
 - key_event/ext_key_event: bool down, uint32_t sym/keycode
 - do_key_event: uint32_t sym
 - framebuffer_update_request: uint8_t incremental, uint16_t x/y/w/h

Drop needless declarations.

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
---
 ui/vnc.c | 39 +++++++++++++++++----------------------
 1 file changed, 17 insertions(+), 22 deletions(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index 9219f593d95..8d91cee4d9f 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -608,15 +608,7 @@ bool vnc_display_reload_certs(const char *id, Error **errp)
    3) resolutions > 1024
 */
 
-static int vnc_update_client(VncState *vs, int has_dirty);
-static void vnc_disconnect_start(VncState *vs);
-
 static void vnc_colordepth(VncState *vs);
-static void framebuffer_update_request(VncState *vs, int incremental,
-                                       int x_position, int y_position,
-                                       int w, int h);
-static void vnc_refresh(DisplayChangeListener *dcl);
-static int vnc_refresh_server_surface(VncDisplay *vd);
 
 static int vnc_width(VncDisplay *vd)
 {
@@ -1763,7 +1755,8 @@ static void check_pointer_type_change(Notifier *notifier, void *data)
     vs->absolute = absolute;
 }
 
-static void pointer_event(VncState *vs, int button_mask, int x, int y)
+static void pointer_event(VncState *vs, uint8_t button_mask,
+                          uint16_t x, uint16_t y)
 {
     static uint32_t bmap[INPUT_BUTTON__MAX] = {
         [INPUT_BUTTON_LEFT]       = 0x01,
@@ -1841,7 +1834,7 @@ static void kbd_leds(Notifier *notifier, void *data)
     }
 }
 
-static void do_key_event(VncState *vs, int down, int keycode, int sym)
+static void do_key_event(VncState *vs, int down, int keycode, uint32_t sym)
 {
     unsigned int lnx = qemu_input_key_number_to_linux(keycode);
 
@@ -2019,7 +2012,7 @@ static const char *code2name(int keycode)
     return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
 }
 
-static void key_event(VncState *vs, int down, uint32_t sym)
+static void key_event(VncState *vs, bool down, uint32_t sym)
 {
     int keycode;
     int lsym = sym;
@@ -2034,8 +2027,8 @@ static void key_event(VncState *vs, int down, uint32_t sym)
     do_key_event(vs, down, keycode, sym);
 }
 
-static void ext_key_event(VncState *vs, int down,
-                          uint32_t sym, uint16_t keycode)
+static void ext_key_event(VncState *vs, bool down,
+                          uint32_t sym, uint32_t keycode)
 {
     /* if the user specifies a keyboard layout, always use it */
     if (keyboard_layout) {
@@ -2046,8 +2039,9 @@ static void ext_key_event(VncState *vs, int down,
     }
 }
 
-static void framebuffer_update_request(VncState *vs, int incremental,
-                                       int x, int y, int w, int h)
+static void framebuffer_update_request(VncState *vs, uint8_t incremental,
+                                       uint16_t x, uint16_t y,
+                                       uint16_t w, uint16_t h)
 {
     if (incremental) {
         if (vs->update != VNC_STATE_UPDATE_FORCE) {
@@ -2250,10 +2244,11 @@ static void send_color_map(VncState *vs)
     vnc_unlock_output(vs);
 }
 
-static void set_pixel_format(VncState *vs, int bits_per_pixel,
-                             int big_endian_flag, int true_color_flag,
-                             int red_max, int green_max, int blue_max,
-                             int red_shift, int green_shift, int blue_shift)
+static void set_pixel_format(VncState *vs, uint8_t bits_per_pixel,
+                             uint8_t big_endian_flag, uint8_t true_color_flag,
+                             uint16_t red_max, uint16_t green_max,
+                             uint16_t blue_max, uint8_t red_shift,
+                             uint8_t green_shift, uint8_t blue_shift)
 {
     if (!true_color_flag) {
         /* Expose a reasonable default 256 color map */
@@ -2286,15 +2281,15 @@ static void set_pixel_format(VncState *vs, int bits_per_pixel,
     vs->client_pf.rmax = red_max ? red_max : 0xFF;
     vs->client_pf.rbits = ctpopl(red_max);
     vs->client_pf.rshift = red_shift;
-    vs->client_pf.rmask = red_max << red_shift;
+    vs->client_pf.rmask = (uint32_t)red_max << red_shift;
     vs->client_pf.gmax = green_max ? green_max : 0xFF;
     vs->client_pf.gbits = ctpopl(green_max);
     vs->client_pf.gshift = green_shift;
-    vs->client_pf.gmask = green_max << green_shift;
+    vs->client_pf.gmask = (uint32_t)green_max << green_shift;
     vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
     vs->client_pf.bbits = ctpopl(blue_max);
     vs->client_pf.bshift = blue_shift;
-    vs->client_pf.bmask = blue_max << blue_shift;
+    vs->client_pf.bmask = (uint32_t)blue_max << blue_shift;
     vs->client_pf.bits_per_pixel = bits_per_pixel;
     vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
     vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;

-- 
2.55.0



  parent reply	other threads:[~2026-07-17 11:53 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-17 11:52 [GIT PULL 00/15] Various UI/security-related fixes for 11.1 Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 01/15] i386/tdx: fix uninitialized variable warning in tdx_check_features Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 02/15] ui/vnc: fix OOB write in vnc_refresh_lossy_rect Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 03/15] ui/vnc: validate color shifts in SetPixelFormat Marc-André Lureau
2026-07-17 11:52 ` Marc-André Lureau [this message]
2026-07-17 11:52 ` [GIT PULL 05/15] ui/input-barrier: fix off-by-one in keycode bounds check Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 06/15] ui/gtk: Narrow DMA-BUF critical section Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 07/15] ui/vnc: fix out-of-bounds write in lossy refresh dirty marking Marc-André Lureau
2026-07-21  8:17   ` Peter Maydell
2026-07-21  8:23     ` Marc-André Lureau
2026-07-21  8:34       ` Peter Maydell
2026-07-17 11:52 ` [GIT PULL 08/15] ui/vnc: validate SetPixelFormat field ranges Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 09/15] hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 10/15] hw/display/qxl: fix TOCTOU in cursor chunk data_size handling Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 11/15] hw/display/virtio-gpu: validate stride against width on scanout Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 12/15] hw/display/virtio-gpu: cap submit_3d command buffer allocation Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 13/15] hw/display/virtio-gpu: handle migration iov allocation failure Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 14/15] hw/display/virtio-gpu: reject strides exceeding INT_MAX Marc-André Lureau
2026-07-17 11:52 ` [GIT PULL 15/15] hw/display/virtio-gpu: Check pixman_image_create_bits() results Marc-André Lureau
2026-07-19  7:31 ` [GIT PULL 00/15] Various UI/security-related fixes for 11.1 Michael Tokarev
2026-07-19  7:33 ` Michael Tokarev
2026-07-19  7:50   ` Akihiko Odaki
2026-07-19  8:07     ` Marc-André Lureau
2026-07-19 11:41       ` Akihiko Odaki
2026-07-20  9:59 ` Stefan Hajnoczi
2026-07-20 11:27 ` Michael Tokarev

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260717-fix-v1-4-cb9f7d49dc52@redhat.com \
    --to=marcandre.lureau@redhat.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.