Fix buffer overrun / damaged options passed to second_stage.

start is a UCS-2 character pointer and loader_len is a number of bytes.
Adjust loader_len to count characters before adding to the start pointer.

1 files changed, 1 insertions, 1 deletions

diff --git a/shim.c b/shim.c
index 9de177f7..f8a1e675 100644
--- a/shim.c
+++ b/shim.c
@@ -2531,7 +2531,7 @@ EFI_STATUS set_second_stage (EFI_HANDLE image_handle)
 		loader_str[loader_len/2-1] = L'\0';
 
 		second_stage = loader_str;
-		load_options = remaining_size ? start + loader_len : NULL;
+		load_options = remaining_size ? start + (loader_len/2) : NULL;
 		load_options_size = remaining_size;
 	}