Gerd Hoffmann d6601a7e1c hw/uefi: fix parse_hexstr ...

Make sure we actually have two input characters available before going
to parse two hex digits.  Fixes one byte buffer overflow of the output
buffer in case the input string has an odd number of characters.

Fixes: CVE-2026-48915
Fixes: 12058948ab ("hw/uefi: add var-service-json.c + qapi for NV vars.")
Reported-by: Feifan Qian <bea1e@proton.me>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20260526135948.599148-1-kraxel@redhat.com>

2026-06-17 09:25:58 +02:00

..

hardware-info.c

…

Kconfig

hw/uefi-vars-sysbus: allow for loongarch virt

2025-03-21 12:01:12 +01:00

LIMITATIONS.md

…

meson.build

hw/uefi: add pcap support

2026-01-20 19:51:36 +01:00

ovmf-log.c

include: move hw/boards.h to hw/core/

2025-12-27 10:11:06 +01:00

trace-events

…

trace.h

hw/uefi: Create and use trace.h wrapper header

2025-07-13 12:08:07 +03:00

var-service-auth.c

hw/uefi: check auth.hdr_length minimum size

2026-05-18 14:59:11 +02:00

var-service-core.c

hw/uefi: verify pio_xfer_offset before calculating buffer checksum

2026-05-08 09:10:38 +02:00

var-service-guid.c

…

var-service-json.c

hw/uefi: fix parse_hexstr

2026-06-17 09:25:58 +02:00

var-service-pcap.c

hw/uefi: add pcap support

2026-01-20 19:51:36 +01:00

var-service-pkcs7-stub.c

…

var-service-pkcs7.c

hw/uefi: check auth.hdr_length minimum size

2026-05-18 14:59:11 +02:00

var-service-policy.c

hw/uefi: Create and use trace.h wrapper header

2025-07-13 12:08:07 +03:00

var-service-siglist.c

…

var-service-sysbus.c

hw/uefi: add pcap support

2026-01-20 19:51:36 +01:00

var-service-utils.c

hw/uefi: fix ucs2 string helper functions

2026-05-08 09:10:38 +02:00

var-service-vars.c

hw/uefi: add name_size check to uefi_vars_mm_lock_variable()

2026-05-08 09:10:38 +02:00