hw/uefi: check lower limit for signature list size
Specifically disallow zero which can lead to an endless loop. Fixes: CVE-2026-61406 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3899 Acked-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260720143244.821889-4-kraxel@redhat.com>
Gerd Hoffmann committed
Jul 20, 2026 at 16:32 UTC
647ba95eda5a21518f84c6593ed97e0447f38a90
1 file changed
+3
hw/uefi/var-service-siglist.c
+3
@@ -94,6 +94,9 @@ void uefi_vars_siglist_parse(uefi_vars_siglist *siglist,
94
break;
95
}
96
efilist = data;
97
+ if (efilist->siglist_size < sizeof(*efilist)) {
98
+ break;
99
+ }
100
if (size < efilist->siglist_size) {
101
break;
102
}