Skip to content

Commit 2815924

Browse files
Fix stack overflow caused by infinite recursion
if p < 4 the loop will continue forever because efidp_node_size (called by efidp_size) returns -1 if the length of the args passed to it are < 4. Resolves: bz#2459982 Resolves: CVE-2026-6862 Signed-off-by: Marta Lewandowska
1 parent d7f5527 commit 2815924

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

src/loadopt.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ efi_loadopt_optional_data_size(efi_load_option *opt, size_t size)
126126
* need to test it. if it /is/ size, there's no optional data. */
127127
sz = ucs2size(opt->description, ret);
128128
p = (uint8_t *)(opt->description) + sz;
129+
if (sizeof(p) < 4)
130+
return -1;
129131
ret -= sz;
130132
if (ret < 0) {
131133
efi_error("leftover size is negative (%zd)", ret);

0 commit comments

Comments
 (0)