Don't leave in_protocol==1 when shim_verify() isn't enforcing.

Right now if shim_verify() sees secure_mode()==0, it exits with
EFI_SUCCESS, but accidentally leaves in_protocol=1.  This means any
other call will have supressed error/warning messages.

That's wrong, so don't do it.

Signed-off-by: Peter Jones <pjones@redhat.com>

1 files changed, 2 insertions, 3 deletions

diff --git a/shim.c b/shim.c
index d66c549c..99b0d0e2 100644
--- a/shim.c
+++ b/shim.c
@@ -1521,17 +1521,16 @@ error:
  */
 EFI_STATUS shim_verify (void *buffer, UINT32 size)
 {
-	EFI_STATUS status;
+	EFI_STATUS status = EFI_SUCCESS;
 	PE_COFF_LOADER_IMAGE_CONTEXT context;
 
 	loader_is_participating = 1;
 	in_protocol = 1;
 
 	if (!secure_mode())
-		return EFI_SUCCESS;
+		goto done;
 
 	status = read_header(buffer, size, &context);
-
 	if (status != EFI_SUCCESS)
 		goto done;