This was never meant to be active in production builds. It's a code path not hit on a normal boot (OVMF wouldn't try variable updates which are not allowed), so this went unnoticed.
Wrap the call into "if (0)" so it never actually called, but we also do not get dead code warnings and can keep the printing function in the code base for debugging. Also fix the name printing to not overrun the entry size. Fixes: CVE-2026-58582 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3615 Signed-off-by: Gerd Hoffmann <[email protected]> --- hw/uefi/var-service-policy.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c index 989bf87ddb86..f78c8f01d62a 100644 --- a/hw/uefi/var-service-policy.c +++ b/hw/uefi/var-service-policy.c @@ -40,11 +40,12 @@ const VMStateDescription vmstate_uefi_var_policy = { static void print_policy_entry(variable_policy_entry *pe) { uint16_t *name = (void *)pe + pe->offset_to_name; + uint16_t *end = (void *)pe + pe->size; fprintf(stderr, "%s:\n", __func__); fprintf(stderr, " name ยด"); - while (*name) { + while (*name && name < end) { fprintf(stderr, "%c", *name); name++; } @@ -173,7 +174,9 @@ efi_status uefi_vars_policy_check(uefi_vars_state *uv, pe = pol->entry; uefi_trace_variable(__func__, var->guid, var->name, var->name_size); - print_policy_entry(pe); + if (0 /* development and debugging only */) { + print_policy_entry(pe); + } if ((var->attributes & pe->attributes_must_have) != pe->attributes_must_have) { trace_uefi_vars_policy_deny("must-have-attr"); -- 2.55.0
