Skip to content

Commit 4e3e1ff

Browse files
Fix stack overflow caused by infinite recursion
If an EFI device path node has 0 length, loop will never terminate. Resolves: bz#2459982 Resolves: CVE-2026-6862 Signed-off-by: Marta Lewandowska <mlewando@redhat.com>
1 parent d7f5527 commit 4e3e1ff

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

src/include/efivar/efivar-dp.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1122,6 +1122,8 @@ efidp_is_valid(const_efidp dp, ssize_t limit)
11221122
efidp_header *next;
11231123
if (limit < (int64_t)(sizeof (efidp_header)))
11241124
return 0;
1125+
if (hdr->length < 4)
1126+
return 0;
11251127

11261128
switch (hdr->type) {
11271129
case EFIDP_HARDWARE_TYPE:

0 commit comments

Comments
 (0)