From: Gerd Hoffmann <[email protected]> Verify the passed buffer has the minimal required length before reading the size field + verifying the total length.
Fixes: CVE-2026-58581 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3614 Acked-by: Luigi Leonardi <[email protected]> Signed-off-by: Gerd Hoffmann <[email protected]> Message-ID: <[email protected]> (cherry picked from commit 702216619e2a1afd5039520114f4d245d7011f09) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c index 58da4adbeba..989bf87ddb8 100644 --- a/hw/uefi/var-service-policy.c +++ b/hw/uefi/var-service-policy.c @@ -276,6 +276,9 @@ static uint32_t uefi_vars_mm_check_policy_register(uefi_vars_state *uv, uefi_var_policy *pol; uint64_t length; + if (mhdr->length < sizeof(*mchk) + sizeof(*pe)) { + return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE); + } if (uadd64_overflow(sizeof(*mchk), pe->size, &length)) { return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE); } -- 2.47.3
