From: Gerd Hoffmann <[email protected]> Specifically disallow zero which can lead to an endless loop.
Fixes: CVE-2026-61406 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3899 Acked-by: Luigi Leonardi <[email protected]> Signed-off-by: Gerd Hoffmann <[email protected]> Message-ID: <[email protected]> (cherry picked from commit 647ba95eda5a21518f84c6593ed97e0447f38a90) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/uefi/var-service-siglist.c b/hw/uefi/var-service-siglist.c index 8948f1b7847..9e03a4dc0c2 100644 --- a/hw/uefi/var-service-siglist.c +++ b/hw/uefi/var-service-siglist.c @@ -94,6 +94,9 @@ void uefi_vars_siglist_parse(uefi_vars_siglist *siglist, break; } efilist = data; + if (efilist->siglist_size < sizeof(*efilist)) { + break; + } if (size < efilist->siglist_size) { break; } -- 2.47.3
