hw/uefi: fix parse_hexstr
Make sure we actually have two input characters available before going to parse two hex digits. Fixes one byte buffer overflow of the output buffer in case the input string has an odd number of characters. Fixes: CVE-2026-48915 Fixes: 12058948abdf ("hw/uefi: add var-service-json.c + qapi for NV vars.") Reported-by: Feifan Qian <bea1e@proton.me> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260526135948.599148-1-kraxel@redhat.com>
Gerd Hoffmann committed
May 26, 2026 at 15:59 UTC
d6601a7e1c2452100ed7e4b1d74a70b9acc0abe6
1 file changed
+1
-1
hw/uefi/var-service-json.c
+1
-1
@@ -98,7 +98,7 @@ static void parse_hexstr(void *dest, char *src, int len)
98
uint8_t *data = dest;
99
size_t i;
100
101
- for (i = 0; i < len; i += 2) {
101
+ for (i = 0; i + 1 < len; i += 2) {
102
*(data++) =
103
parse_hexchar(src[i]) << 4 |
104
parse_hexchar(src[i + 1]);