hw/uefi: verify data size before accessing it in wrap_pkcs7
Fixes: CVE-2026-41439 Fixes: 3e33af2cb306 ("hw/uefi: add var-service-pkcs7.c") Reported-by: Katherine Leaver <katherine.j.leaver@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260422092910.444997-6-kraxel@redhat.com>
Gerd Hoffmann committed
Apr 22, 2026 at 11:29 UTC
22b7b222d8f5428be8b5d4787f36efd0a0b75292
1 file changed
+2
-1
hw/uefi/var-service-pkcs7.c
+2
-1
@@ -73,7 +73,8 @@ static void wrap_pkcs7(gnutls_datum_t *pkcs7)
73
};
74
gnutls_datum_t wrap;
75
76
- if (pkcs7->data[4] == 0x06 &&
76
+ if (pkcs7->size > 16 &&
77
+ pkcs7->data[4] == 0x06 &&
78
pkcs7->data[5] == 0x09 &&
79
memcmp(pkcs7->data + 6, signed_data_oid, sizeof(signed_data_oid)) == 0 &&
80
pkcs7->data[15] == 0x0a &&