Reject the binary when there is no key in MokList

1 files changed, 3 insertions, 1 deletions

diff --git a/shim.c b/shim.c
index 43297297..73b2feb7 100644
--- a/shim.c
+++ b/shim.c
@@ -617,8 +617,10 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
 	}
 
 	CopyMem(&MokNum, MokListData, sizeof(UINT32));
-	if (MokNum == 0)
+	if (MokNum == 0) {
+		status = EFI_ACCESS_DENIED;
 		goto done;
+	}
 
 	list = build_mok_list(MokNum,
 			      (void *)MokListData + sizeof(UINT32),