[PATCH v3 3/5] hw/uefi: check lower limit for signature list size

[Gerd Hoffmann]

Specifically disallow zero which can lead to an endless loop.

Fixes: CVE-2026-61406
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3899
Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
---
 hw/uefi/var-service-siglist.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/uefi/var-service-siglist.c b/hw/uefi/var-service-siglist.c
index 8948f1b78471..9e03a4dc0c28 100644
--- a/hw/uefi/var-service-siglist.c
+++ b/hw/uefi/var-service-siglist.c
@@ -94,6 +94,9 @@ void uefi_vars_siglist_parse(uefi_vars_siglist *siglist,
             break;
         }
         efilist = data;
+        if (efilist->siglist_size < sizeof(*efilist)) {
+            break;
+        }
         if (size < efilist->siglist_size) {
             break;
         }
-- 
2.55.0