This was never meant to be active in production builds. It's a code path not hit on a normal boot (OVMF wouldn't try variable updates which are not allowed), so this went unnoticed.
Wrap the call into "if (VARIABLE_POLICY_DEBUG)" so it is never used unless the #define is changed to true. Also fix the name printing to not overrun the entry size. Fixes: CVE-2026-58582 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3615 Signed-off-by: Gerd Hoffmann <[email protected]> --- hw/uefi/var-service-policy.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c index 989bf87ddb86..b56fc62f7092 100644 --- a/hw/uefi/var-service-policy.c +++ b/hw/uefi/var-service-policy.c @@ -16,6 +16,8 @@ #include "trace.h" +#define VARIABLE_POLICY_DEBUG 0 + static void calc_policy(uefi_var_policy *pol); static int uefi_var_policy_post_load(void *opaque, int version_id) @@ -40,11 +42,12 @@ const VMStateDescription vmstate_uefi_var_policy = { static void print_policy_entry(variable_policy_entry *pe) { uint16_t *name = (void *)pe + pe->offset_to_name; + uint16_t *end = (void *)pe + pe->size; fprintf(stderr, "%s:\n", __func__); fprintf(stderr, " name ´"); - while (*name) { + while (*name && name < end) { fprintf(stderr, "%c", *name); name++; } @@ -173,7 +176,9 @@ efi_status uefi_vars_policy_check(uefi_vars_state *uv, pe = pol->entry; uefi_trace_variable(__func__, var->guid, var->name, var->name_size); - print_policy_entry(pe); + if (VARIABLE_POLICY_DEBUG) { + print_policy_entry(pe); + } if ((var->attributes & pe->attributes_must_have) != pe->attributes_must_have) { trace_uefi_vars_policy_deny("must-have-attr"); -- 2.55.0
