[PATCH v2 2/2] hw/uefi: disable debug function

[Gerd Hoffmann <kraxel@redhat.com>]

This was never meant to be active in production builds.  It's a code
path not hit on a normal boot (OVMF wouldn't try variable updates which
are not allowed), so this went unnoticed.

Wrap the call into "if (VARIABLE_POLICY_DEBUG)" so it is never used
unless the #define is changed to true.

Also fix the name printing to not overrun the entry size.

Fixes: CVE-2026-58582
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3615
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/uefi/var-service-policy.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c
index 989bf87ddb86..b56fc62f7092 100644
--- a/hw/uefi/var-service-policy.c
+++ b/hw/uefi/var-service-policy.c
@@ -16,6 +16,8 @@
 
 #include "trace.h"
 
+#define VARIABLE_POLICY_DEBUG 0
+
 static void calc_policy(uefi_var_policy *pol);
 
 static int uefi_var_policy_post_load(void *opaque, int version_id)
@@ -40,11 +42,12 @@ const VMStateDescription vmstate_uefi_var_policy = {
 static void print_policy_entry(variable_policy_entry *pe)
 {
     uint16_t *name = (void *)pe + pe->offset_to_name;
+    uint16_t *end = (void *)pe + pe->size;
 
     fprintf(stderr, "%s:\n", __func__);
 
     fprintf(stderr, "    name ´");
-    while (*name) {
+    while (*name && name < end) {
         fprintf(stderr, "%c", *name);
         name++;
     }
@@ -173,7 +176,9 @@ efi_status uefi_vars_policy_check(uefi_vars_state *uv,
     pe = pol->entry;
 
     uefi_trace_variable(__func__, var->guid, var->name, var->name_size);
-    print_policy_entry(pe);
+    if (VARIABLE_POLICY_DEBUG) {
+        print_policy_entry(pe);
+    }
 
     if ((var->attributes & pe->attributes_must_have) != pe->attributes_must_have) {
         trace_uefi_vars_policy_deny("must-have-attr");
-- 
2.55.0