From adf385ecab69631952bdc8b774ebd77e82b94a00 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 16 Jan 2025 15:42:13 +0100
Subject: [PATCH 03/10] OvmfPkg/QemuKernelLoaderFsDxe: allow longer file names

QEMU_FW_CFG_FNAME_SIZE is 56. 'etc/boot/' prefix is minus 9.  Add one
for the terminating '\0'.  Effective max size is 48.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

CVE: CVE-2025-2296
Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/adf385ecab69631952bdc8b774ebd77e82b94a00]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
 OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
index 1f63adda0b..0947b6bf2d 100644
--- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
+++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
@@ -33,7 +33,7 @@
 // Static data that hosts the fw_cfg blobs and serves file requests.
 //
 typedef struct {
-  CHAR16    Name[8];
+  CHAR16    Name[48];
   struct {
     FIRMWARE_CONFIG_ITEM    SizeKey;
     FIRMWARE_CONFIG_ITEM    DataKey;
@@ -43,7 +43,7 @@ typedef struct {
 
 typedef struct KERNEL_BLOB KERNEL_BLOB;
 struct KERNEL_BLOB {
-  CHAR16         Name[8];
+  CHAR16         Name[48];
   UINT32         Size;
   UINT8          *Data;
   KERNEL_BLOB    *Next;
-- 
2.49.0

