[PATCH] ui/dbus: validate clipboard selection in Release handler

[PATCH] ui/dbus: validate clipboard selection in Release handler

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

The clipboard "Release" D-Bus method handler passes the caller provided
selection to qemu_clipboard_peer_release() without any bounds check,
unlike the "Grab" and "Request" handlers.

An out-of-range selection reaches qemu_clipboard_info(), which asserts
selection < QEMU_CLIPBOARD_SELECTION__COUNT and aborts QEMU (with
asserts compiled out, it would index the cbinfo[] array out of bounds).

Reject invalid selections with an error, following the same pattern as
the other clipboard handlers.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4717
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/dbus-clipboard.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/ui/dbus-clipboard.c b/ui/dbus-clipboard.c
index 90318384ee48..44764fff8081 100644
--- a/ui/dbus-clipboard.c
+++ b/ui/dbus-clipboard.c
@@ -346,11 +346,22 @@ dbus_clipboard_release(
     GDBusMethodInvocation *invocation,
     gint arg_selection)
 {
+    QemuClipboardSelection s = arg_selection;
+
     if (!dbus_clipboard_check_caller(dpy, invocation)) {
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
 
-    qemu_clipboard_peer_release(&dpy->clipboard_peer, arg_selection);
+    if (s >= QEMU_CLIPBOARD_SELECTION__COUNT) {
+        g_dbus_method_invocation_return_error(
+            invocation,
+            DBUS_DISPLAY_ERROR,
+            DBUS_DISPLAY_ERROR_FAILED,
+            "Invalid clipboard selection: %d", arg_selection);
+        return DBUS_METHOD_INVOCATION_HANDLED;
+    }
+
+    qemu_clipboard_peer_release(&dpy->clipboard_peer, s);
 
     qemu_dbus_display1_clipboard_complete_release(dpy->clipboard, invocation);
     return DBUS_METHOD_INVOCATION_HANDLED;
-- 
2.56.0.116.g6de20f6092dc

Re: [PATCH] ui/dbus: validate clipboard selection in Release handler

[Peter Maydell]

On Mon, 19 Oct 2026 at 10:48, <marcandre.lureau@redhat.com> wrote:
>
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
>
> The clipboard "Release" D-Bus method handler passes the caller provided
> selection to qemu_clipboard_peer_release() without any bounds check,
> unlike the "Grab" and "Request" handlers.
>
> An out-of-range selection reaches qemu_clipboard_info(), which asserts
> selection < QEMU_CLIPBOARD_SELECTION__COUNT and aborts QEMU (with
> asserts compiled out, it would index the cbinfo[] array out of bounds).

Note that it is not possible to build QEMU with assertions compiled
out, unless you nobble the QEMU source code to disable the checks
osdep.h has that prevent you from disabling assertions. So we don't
need to care about what behaviour is in that hypothetical situation.
(LLM-generated bug reports frequently fail to understand this.)

>
> Reject invalid selections with an error, following the same pattern as
> the other clipboard handlers.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4717
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

thanks
-- PMM

Re: [PATCH] ui/dbus: validate clipboard selection in Release handler

[Daniel P. Berrangé]

On Mon, Oct 19, 2026 at 01:23:51PM +0400, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> The clipboard "Release" D-Bus method handler passes the caller provided
> selection to qemu_clipboard_peer_release() without any bounds check,
> unlike the "Grab" and "Request" handlers.
> 
> An out-of-range selection reaches qemu_clipboard_info(), which asserts
> selection < QEMU_CLIPBOARD_SELECTION__COUNT and aborts QEMU (with
> asserts compiled out, it would index the cbinfo[] array out of bounds).
> 
> Reject invalid selections with an error, following the same pattern as
> the other clipboard handlers.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4717
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  ui/dbus-clipboard.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)

If you remove the text about "with asserts compiled out..." as Peter
suggested, then

  Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|