On Thu, 2 Jul 2026 at 10:06, Gerd Hoffmann <[email protected]> wrote:
>
> This was never meant to be active in production builds.  It's a code
> path not hit on a normal boot (OVMF wouldn't try variable updates which
> are not allowed), so this went unnoticed.
>
> Wrap the call into "if (0)" so it never actually called, but we also do
> not get dead code warnings and can keep the printing function in the code
> base for debugging.
>
> Also fix the name printing to not overrun the entry size.

This is burying the lede...

>
> Fixes: CVE-2026-58582
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3615
> Signed-off-by: Gerd Hoffmann <[email protected]>
> ---
>  hw/uefi/var-service-policy.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c
> index 989bf87ddb86..f78c8f01d62a 100644
> --- a/hw/uefi/var-service-policy.c
> +++ b/hw/uefi/var-service-policy.c
> @@ -40,11 +40,12 @@ const VMStateDescription vmstate_uefi_var_policy = {
>  static void print_policy_entry(variable_policy_entry *pe)
>  {
>      uint16_t *name = (void *)pe + pe->offset_to_name;
> +    uint16_t *end = (void *)pe + pe->size;
>
>      fprintf(stderr, "%s:\n", __func__);
>
>      fprintf(stderr, "    name ยด");
> -    while (*name) {
> +    while (*name && name < end) {
>          fprintf(stderr, "%c", *name);
>          name++;
>      }
> @@ -173,7 +174,9 @@ efi_status uefi_vars_policy_check(uefi_vars_state *uv,
>      pe = pol->entry;
>
>      uefi_trace_variable(__func__, var->guid, var->name, var->name_size);
> -    print_policy_entry(pe);
> +    if (0 /* development and debugging only */) {
> +        print_policy_entry(pe);
> +    }

Please don't add "if (0)" to the codebase. Either drop the
code entirely, or use a named #define, or convert to tracepoints.

thanks
-- PMM

Reply via email to