On Thu, 2 Jul 2026 at 10:06, Gerd Hoffmann <[email protected]> wrote: > > This was never meant to be active in production builds. It's a code > path not hit on a normal boot (OVMF wouldn't try variable updates which > are not allowed), so this went unnoticed. > > Wrap the call into "if (0)" so it never actually called, but we also do > not get dead code warnings and can keep the printing function in the code > base for debugging. > > Also fix the name printing to not overrun the entry size.
This is burying the lede... > > Fixes: CVE-2026-58582 > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3615 > Signed-off-by: Gerd Hoffmann <[email protected]> > --- > hw/uefi/var-service-policy.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c > index 989bf87ddb86..f78c8f01d62a 100644 > --- a/hw/uefi/var-service-policy.c > +++ b/hw/uefi/var-service-policy.c > @@ -40,11 +40,12 @@ const VMStateDescription vmstate_uefi_var_policy = { > static void print_policy_entry(variable_policy_entry *pe) > { > uint16_t *name = (void *)pe + pe->offset_to_name; > + uint16_t *end = (void *)pe + pe->size; > > fprintf(stderr, "%s:\n", __func__); > > fprintf(stderr, " name ยด"); > - while (*name) { > + while (*name && name < end) { > fprintf(stderr, "%c", *name); > name++; > } > @@ -173,7 +174,9 @@ efi_status uefi_vars_policy_check(uefi_vars_state *uv, > pe = pol->entry; > > uefi_trace_variable(__func__, var->guid, var->name, var->name_size); > - print_policy_entry(pe); > + if (0 /* development and debugging only */) { > + print_policy_entry(pe); > + } Please don't add "if (0)" to the codebase. Either drop the code entirely, or use a named #define, or convert to tracepoints. thanks -- PMM
