Browse Source

hw/uefi: fix error handling in uefi_vars_json_load

Catch lseek errors.  Return on read errors.

Fixes: CID 1593154
Fixes: CID 1593157
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20250319141159.1461621-4-kraxel@redhat.com>
Gerd Hoffmann 5 months ago
parent
commit
761d0b5fb7
1 changed files with 8 additions and 1 deletions
  1. 8 1
      hw/uefi/var-service-json.c

+ 8 - 1
hw/uefi/var-service-json.c

@@ -214,7 +214,7 @@ void uefi_vars_json_load(uefi_vars_state *uv, Error **errp)
     QObject *qobj;
     QObject *qobj;
     Visitor *v;
     Visitor *v;
     char *str;
     char *str;
-    size_t len;
+    ssize_t len;
     int rc;
     int rc;
 
 
     if (uv->jsonfd == -1) {
     if (uv->jsonfd == -1) {
@@ -222,7 +222,12 @@ void uefi_vars_json_load(uefi_vars_state *uv, Error **errp)
     }
     }
 
 
     len = lseek(uv->jsonfd, 0, SEEK_END);
     len = lseek(uv->jsonfd, 0, SEEK_END);
+    if (len < 0) {
+        warn_report("%s: lseek error", __func__);
+        return;
+    }
     if (len == 0) {
     if (len == 0) {
+        /* empty file */
         return;
         return;
     }
     }
 
 
@@ -231,6 +236,8 @@ void uefi_vars_json_load(uefi_vars_state *uv, Error **errp)
     rc = read(uv->jsonfd, str, len);
     rc = read(uv->jsonfd, str, len);
     if (rc != len) {
     if (rc != len) {
         warn_report("%s: read error", __func__);
         warn_report("%s: read error", __func__);
+        g_free(str);
+        return;
     }
     }
     str[len] = 0;
     str[len] = 0;