From nobody Tue Aug 25 08:46:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1779486774; cv=none; d=zohomail.com; s=zohoarc; b=kdXHwiRzFZsLVjlZvi43qGl0uQhsDCgE789BT4FTJ6wcDJDD4OBCqjNavMB6munIqmBoEiLSNziJvJX56ZB44xg1uwQsO2bdgNwizi/S/ZKox0rBNLuL8HPke22GxGBDD4jai1DVsFp1lOybmJSMBUqq21026HviGpfO+bL0H80= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779486774; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zGw7nSNusu90GdlFNQmCioSIIlgEJtbJHM5dwt7gaKw=; b=MBNd9T1jCSFMwMNmrwldqJ9Rx9oNy8ah0ELUHpfnOxg5HBpHfdWlCzSvDQkYGSJSZzEl6L9H1GxQl39LshWmrz4aW5/rDGtlIL+L00K0+R09SfIf0dWETPHJx8342yU9HT3qegFnfMGPRxcWx8VTW0paxBMlkk5wT5MtuYX62RU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779486774493251.52338719833415; Fri, 22 May 2026 14:52:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQXlh-00011n-TN; Fri, 22 May 2026 17:50:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXl2-0007o8-3J; Fri, 22 May 2026 17:50:16 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXky-0003IQ-Fo; Fri, 22 May 2026 17:50:15 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id F1ADF1AFB68; Sat, 23 May 2026 00:49:19 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 251D63B71B7; Sat, 23 May 2026 00:49:24 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1779486559; bh=tGCFPzas1hHKzOl+cALrD/N2SyuwGyZAQXj2RFisqsM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=rzknWhoBorf30bXcV8FJv1z+ps14+/QyaPGmyhsEbNHvtgjC2AGhjNwOoqHyJIBAt 10hnddiZTzAc1kg6VdQiksP7F5nukP8K+0ChPtJ5MnCs9h8J1BUAKI60yTmMWgUa4X kDT7yQ4NrYj1uF993+zkML/GqZyPmisLnXoUZs4b6lHLBpnsq7NYsIXB8cSLzIg8E8 wbcJ24x3rR60H/+4MiVEdkT8E2mvetsT2MZr3Kkeo7hreu+VBscFrEpkCtZlM0tLph DFYNZyinVeQxZp5SxQq2bxmkvGmaQgO0+NEXWtd9ng+b3R7ebZv8hDMEr+lwSejOzc Mac8t6sD94m4A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Gerd Hoffmann , Katherine Leaver , Michael Tokarev Subject: [Stable-10.2.3 114/149] hw/uefi: fix ucs2 string helper functions Date: Sat, 23 May 2026 00:48:46 +0300 Message-ID: <20260522214923.807017-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1779486776304154100 Content-Type: text/plain; charset="utf-8" From: Gerd Hoffmann The length passed in is in bytes not characters. Rename the parameters to make that clear. Calculate the number of chars if needed. Fix length checks to use the number of chars not bytes to avoid OOB reads. Fixes: CVE-2026-41437 Fixes: 1ebc319c8ca7 ("hw/uefi: add var-service-utils.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann Message-ID: <20260422092910.444997-4-kraxel@redhat.com> (cherry picked from commit 5247b3034c23bdfd91a7f78587c3b3e37f90568c) Signed-off-by: Michael Tokarev diff --git a/hw/uefi/var-service-utils.c b/hw/uefi/var-service-utils.c index 258013f436..489321a26c 100644 --- a/hw/uefi/var-service-utils.c +++ b/hw/uefi/var-service-utils.c @@ -19,13 +19,18 @@ * sometimes when they are not (for example in variable policies). */ =20 -gboolean uefi_str_is_valid(const uint16_t *str, size_t len, +gboolean uefi_str_is_valid(const uint16_t *str, size_t bytes, gboolean must_be_null_terminated) { + size_t chars =3D bytes / 2; size_t pos =3D 0; =20 + if ((bytes % 2) !=3D 0) { + return false; + } + for (;;) { - if (pos =3D=3D len) { + if (pos =3D=3D chars) { if (must_be_null_terminated) { return false; } else { @@ -47,12 +52,13 @@ gboolean uefi_str_is_valid(const uint16_t *str, size_t = len, } } =20 -size_t uefi_strlen(const uint16_t *str, size_t len) +size_t uefi_strlen(const uint16_t *str, size_t bytes) { + size_t chars =3D bytes / 2; size_t pos =3D 0; =20 for (;;) { - if (pos =3D=3D len) { + if (pos =3D=3D chars) { return pos; } if (str[pos] =3D=3D 0) { @@ -62,25 +68,25 @@ size_t uefi_strlen(const uint16_t *str, size_t len) } } =20 -gboolean uefi_str_equal_ex(const uint16_t *a, size_t alen, - const uint16_t *b, size_t blen, +gboolean uefi_str_equal_ex(const uint16_t *a, size_t a_bytes, + const uint16_t *b, size_t b_bytes, gboolean wildcards_in_a) { + size_t a_chars =3D a_bytes / 2; + size_t b_chars =3D b_bytes / 2; size_t pos =3D 0; =20 - alen =3D alen / 2; - blen =3D blen / 2; for (;;) { - if (pos =3D=3D alen && pos =3D=3D blen) { + if (pos =3D=3D a_chars && pos =3D=3D b_chars) { return true; } - if (pos =3D=3D alen && b[pos] =3D=3D 0) { + if (pos =3D=3D a_chars && b[pos] =3D=3D 0) { return true; } - if (pos =3D=3D blen && a[pos] =3D=3D 0) { + if (pos =3D=3D b_chars && a[pos] =3D=3D 0) { return true; } - if (pos =3D=3D alen || pos =3D=3D blen) { + if (pos =3D=3D a_chars || pos =3D=3D b_chars) { return false; } if (a[pos] =3D=3D 0 && b[pos] =3D=3D 0) { @@ -100,18 +106,18 @@ gboolean uefi_str_equal_ex(const uint16_t *a, size_t = alen, } } =20 -gboolean uefi_str_equal(const uint16_t *a, size_t alen, - const uint16_t *b, size_t blen) +gboolean uefi_str_equal(const uint16_t *a, size_t a_bytes, + const uint16_t *b, size_t b_bytes) { - return uefi_str_equal_ex(a, alen, b, blen, false); + return uefi_str_equal_ex(a, a_bytes, b, b_bytes, false); } =20 -char *uefi_ucs2_to_ascii(const uint16_t *ucs2, uint64_t ucs2_size) +char *uefi_ucs2_to_ascii(const uint16_t *ucs2, uint64_t ucs2_bytes) { - char *str =3D g_malloc0(ucs2_size / 2 + 1); + char *str =3D g_malloc0(ucs2_bytes / 2 + 1); int i; =20 - for (i =3D 0; i * 2 < ucs2_size; i++) { + for (i =3D 0; i * 2 < ucs2_bytes; i++) { if (ucs2[i] =3D=3D 0) { break; } --=20 2.47.3