Commit 647ba95eda for qemu.org

commit 647ba95eda5a21518f84c6593ed97e0447f38a90
Author: Gerd Hoffmann <kraxel@redhat.com>
Date:   Mon Jul 20 16:32:39 2026 +0200

    hw/uefi: check lower limit for signature list size

    Specifically disallow zero which can lead to an endless loop.

    Fixes: CVE-2026-61406
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3899
    Acked-by: Luigi Leonardi <leonardi@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-ID: <20260720143244.821889-4-kraxel@redhat.com>

diff --git a/hw/uefi/var-service-siglist.c b/hw/uefi/var-service-siglist.c
index 8948f1b784..9e03a4dc0c 100644
--- a/hw/uefi/var-service-siglist.c
+++ b/hw/uefi/var-service-siglist.c
@@ -94,6 +94,9 @@ void uefi_vars_siglist_parse(uefi_vars_siglist *siglist,
             break;
         }
         efilist = data;
+        if (efilist->siglist_size < sizeof(*efilist)) {
+            break;
+        }
         if (size < efilist->siglist_size) {
             break;
         }