From d6601a7e1c2452100ed7e4b1d74a70b9acc0abe6 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Tue, 26 May 2026 15:59:48 +0200 Subject: [PATCH] hw/uefi: fix parse_hexstr MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Make sure we actually have two input characters available before going to parse two hex digits. Fixes one byte buffer overflow of the output buffer in case the input string has an odd number of characters. Fixes: CVE-2026-48915 Fixes: 12058948abdf ("hw/uefi: add var-service-json.c + qapi for NV vars.") Reported-by: Feifan Qian Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Gerd Hoffmann Message-ID: <20260526135948.599148-1-kraxel@redhat.com> --- hw/uefi/var-service-json.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/uefi/var-service-json.c b/hw/uefi/var-service-json.c index f5f1556833..8621b86c5c 100644 --- a/hw/uefi/var-service-json.c +++ b/hw/uefi/var-service-json.c @@ -98,7 +98,7 @@ static void parse_hexstr(void *dest, char *src, int len) uint8_t *data = dest; size_t i; - for (i = 0; i < len; i += 2) { + for (i = 0; i + 1 < len; i += 2) { *(data++) = parse_hexchar(src[i]) << 4 | parse_hexchar(src[i + 1]);