Commit 702216619e for qemu.org

commit 702216619e2a1afd5039520114f4d245d7011f09
Author: Gerd Hoffmann <kraxel@redhat.com>
Date:   Mon Jul 20 16:32:37 2026 +0200

    hw/uefi: add sanity check

    Verify the passed buffer has the minimal required length before
    reading the size field + verifying the total length.

    Fixes: CVE-2026-58581
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3614
    Acked-by: Luigi Leonardi <leonardi@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-ID: <20260720143244.821889-2-kraxel@redhat.com>

diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c
index 58da4adbeb..989bf87ddb 100644
--- a/hw/uefi/var-service-policy.c
+++ b/hw/uefi/var-service-policy.c
@@ -276,6 +276,9 @@ static uint32_t uefi_vars_mm_check_policy_register(uefi_vars_state *uv,
     uefi_var_policy *pol;
     uint64_t length;

+    if (mhdr->length < sizeof(*mchk) + sizeof(*pe)) {
+        return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE);
+    }
     if (uadd64_overflow(sizeof(*mchk), pe->size, &length)) {
         return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE);
     }