From 58cf755d5fd5b3d1f87a5936107a70705ccbb57b Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Thu, 25 Feb 2021 23:18:24 -0500
Subject: Add get_variable_size()/set_variable()del_variable() wrappers.

This get_variable_size() implementation success in either of two cases:
- EFI_SUCCESS with *lenp == 0 if the variable isn't found
- EFI_SUCCESS with *lenp > 0 on success

In the event of other errors, it returns them to you.

There's nothing particularly interesting about the set_variable()
or del_variable() implementation here.

Signed-off-by: Peter Jones <pjones@redhat.com>
---
 lib/variables.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

(limited to 'lib/variables.c')

diff --git a/lib/variables.c b/lib/variables.c
index 0431d4a2..6db069ef 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -259,6 +259,43 @@ get_variable(const CHAR16 * const var, UINT8 **data, UINTN *len, EFI_GUID owner)
 	return get_variable_attr(var, data, len, owner, NULL);
 }
 
+EFI_STATUS
+get_variable_size(const CHAR16 * const var, EFI_GUID owner, UINTN *lenp)
+{
+	UINTN len = 0;
+	EFI_STATUS efi_status;
+
+	efi_status = get_variable_attr(var, NULL, &len, owner, NULL);
+	if (EFI_ERROR(efi_status)) {
+		if (efi_status == EFI_BUFFER_TOO_SMALL) {
+			*lenp = len;
+			return EFI_SUCCESS;
+		} else if (efi_status == EFI_NOT_FOUND) {
+			*lenp = 0;
+			return EFI_SUCCESS;
+		}
+		return efi_status;
+	}
+	/*
+	 * who knows what this means, but...
+	 */
+	*lenp = len;
+	return efi_status;
+}
+
+EFI_STATUS
+set_variable(CHAR16 *var, EFI_GUID owner, UINT32 attributes,
+	     UINTN datasize, void *data)
+{
+	return gRT->SetVariable(var, &owner, attributes, datasize, data);
+}
+
+EFI_STATUS
+del_variable(CHAR16 *var, EFI_GUID owner)
+{
+	return set_variable(var, owner, 0, 0, "");
+}
+
 EFI_STATUS
 find_in_esl(UINT8 *Data, UINTN DataSize, UINT8 *key, UINTN keylen)
 {
-- 
cgit v1.2.3


From f033a1da9f4c3acf7e3dfef906d01e348b6fcf42 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Tue, 9 Mar 2021 11:42:34 -0500
Subject: Restructure our includes.

This re-structures our includes so we can be sure everything is always
including all the system headers in a uniform, predictable way.

Temporarily it also adds a bunch of junk at all the places we use
variadic functions to specifically pick either the MS (cdecl) or ELF
ABIs.

I'm not 100% sure that's all correct (see later patch) but it's enough
to allow this to build.

Signed-off-by: Peter Jones <pjones@redhat.com>
---
 Cryptlib/Include/OpenSslSupport.h     | 13 +++++++-----
 Cryptlib/Include/ctype.h              | 16 --------------
 Cryptlib/Include/openssl/crypto.h     |  1 +
 Cryptlib/Include/stdarg.h             | 16 --------------
 Cryptlib/Include/stddef.h             | 15 --------------
 Cryptlib/Include/stdlib.h             | 16 --------------
 Cryptlib/Include/string.h             | 16 --------------
 Cryptlib/Include/strings.h            | 15 --------------
 Cryptlib/InternalCryptLib.h           |  2 ++
 Cryptlib/Makefile                     | 14 +++++++++----
 Cryptlib/OpenSSL/Makefile             | 16 +++++++++-----
 Cryptlib/OpenSSL/crypto/bio/b_print.c |  8 +++----
 Make.defaults                         |  3 ++-
 Makefile                              |  7 ++++---
 MokManager.c                          |  8 +------
 PasswordCrypt.c                       |  6 ++----
 crypt_blowfish.c                      |  5 -----
 errlog.c                              | 29 +++++++++++++-------------
 fallback.c                            |  4 ----
 httpboot.c                            |  4 ----
 include/console.h                     |  8 +++----
 include/hexdump.h                     | 17 ++++++++-------
 include/system/alloca.h               | 10 +++++++++
 include/system/ctype.h                | 14 +++++++++++++
 include/system/inttypes.h             | 13 ++++++++++++
 include/system/stdarg.h               | 31 ++++++++++++++++++++++++++++
 include/system/stdio.h                | 13 ++++++++++++
 include/system/stdlib.h               | 16 ++++++++++++++
 include/system/string.h               | 14 +++++++++++++
 include/system/strings.h              | 10 +++++++++
 include/test.h                        |  4 ++--
 lib/Makefile                          | 39 +++++++++++++++++++++++++++++++++--
 lib/configtable.c                     |  3 ---
 lib/console.c                         | 21 +++++++------------
 lib/execute.c                         |  4 ----
 lib/print_crypto.c                    |  5 -----
 lib/security_policy.c                 |  4 ----
 lib/shell.c                           |  3 ---
 lib/simple_file.c                     |  4 ----
 lib/variables.c                       |  3 ---
 mok.c                                 |  4 ----
 netboot.c                             |  2 --
 pe.c                                  |  1 -
 replacements.c                        |  5 -----
 sbat.c                                |  1 -
 shim.c                                |  1 -
 shim.h                                | 25 ++++++++++++++++------
 test.c                                |  3 ++-
 tpm.c                                 |  6 ------
 49 files changed, 262 insertions(+), 236 deletions(-)
 delete mode 100644 Cryptlib/Include/ctype.h
 delete mode 100644 Cryptlib/Include/stdarg.h
 delete mode 100644 Cryptlib/Include/stddef.h
 delete mode 100644 Cryptlib/Include/stdlib.h
 delete mode 100644 Cryptlib/Include/string.h
 delete mode 100644 Cryptlib/Include/strings.h
 create mode 100644 include/system/alloca.h
 create mode 100644 include/system/ctype.h
 create mode 100644 include/system/inttypes.h
 create mode 100644 include/system/stdarg.h
 create mode 100644 include/system/stdio.h
 create mode 100644 include/system/stdlib.h
 create mode 100644 include/system/string.h
 create mode 100644 include/system/strings.h

(limited to 'lib/variables.c')

diff --git a/Cryptlib/Include/OpenSslSupport.h b/Cryptlib/Include/OpenSslSupport.h
index 0b555271..7af9650f 100644
--- a/Cryptlib/Include/OpenSslSupport.h
+++ b/Cryptlib/Include/OpenSslSupport.h
@@ -15,6 +15,14 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #ifndef __OPEN_SSL_SUPPORT_H__
 #define __OPEN_SSL_SUPPORT_H__
 
+/*
+ * Include stddef.h to avoid redefining "offsetof"
+ */
+#include <stddef.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <string.h>
+
 #include <efi.h>
 #include <efilib.h>
 #include "Base.h"
@@ -23,11 +31,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include "Library/MemoryAllocationLib.h"
 #include "Library/DebugLib.h"
 
-/*
- * Include stddef.h to avoid redefining "offsetof"
- */
-#include <stddef.h>
-
 #define CONST const
 
 //
diff --git a/Cryptlib/Include/ctype.h b/Cryptlib/Include/ctype.h
deleted file mode 100644
index ee07f6bc..00000000
--- a/Cryptlib/Include/ctype.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/** @file
-  Include file to support building OpenSSL Crypto Library.
-
-Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <OpenSslSupport.h>
-
diff --git a/Cryptlib/Include/openssl/crypto.h b/Cryptlib/Include/openssl/crypto.h
index bea4ca19..e201a123 100644
--- a/Cryptlib/Include/openssl/crypto.h
+++ b/Cryptlib/Include/openssl/crypto.h
@@ -117,6 +117,7 @@
 #ifndef HEADER_CRYPTO_H
 # define HEADER_CRYPTO_H
 
+# include <string.h>
 # include <stdlib.h>
 
 # include <openssl/e_os2.h>
diff --git a/Cryptlib/Include/stdarg.h b/Cryptlib/Include/stdarg.h
deleted file mode 100644
index ee07f6bc..00000000
--- a/Cryptlib/Include/stdarg.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/** @file
-  Include file to support building OpenSSL Crypto Library.
-
-Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <OpenSslSupport.h>
-
diff --git a/Cryptlib/Include/stddef.h b/Cryptlib/Include/stddef.h
deleted file mode 100644
index 8dfc36ff..00000000
--- a/Cryptlib/Include/stddef.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/** @file
-  Include file to support building OpenSSL Crypto Library.
-
-Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <OpenSslSupport.h>
diff --git a/Cryptlib/Include/stdlib.h b/Cryptlib/Include/stdlib.h
deleted file mode 100644
index ee07f6bc..00000000
--- a/Cryptlib/Include/stdlib.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/** @file
-  Include file to support building OpenSSL Crypto Library.
-
-Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <OpenSslSupport.h>
-
diff --git a/Cryptlib/Include/string.h b/Cryptlib/Include/string.h
deleted file mode 100644
index ee07f6bc..00000000
--- a/Cryptlib/Include/string.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/** @file
-  Include file to support building OpenSSL Crypto Library.
-
-Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <OpenSslSupport.h>
-
diff --git a/Cryptlib/Include/strings.h b/Cryptlib/Include/strings.h
deleted file mode 100644
index 8dfc36ff..00000000
--- a/Cryptlib/Include/strings.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/** @file
-  Include file to support building OpenSSL Crypto Library.
-
-Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <OpenSslSupport.h>
diff --git a/Cryptlib/InternalCryptLib.h b/Cryptlib/InternalCryptLib.h
index e9a4c20a..dc1a95e6 100644
--- a/Cryptlib/InternalCryptLib.h
+++ b/Cryptlib/InternalCryptLib.h
@@ -15,6 +15,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #ifndef __INTERNAL_CRYPT_LIB_H__
 #define __INTERNAL_CRYPT_LIB_H__
 
+#include <stdarg.h>
+
 #include "Library/BaseLib.h"
 #include "Library/BaseMemoryLib.h"
 #include "Library/MemoryAllocationLib.h"
diff --git a/Cryptlib/Makefile b/Cryptlib/Makefile
index bc5681c5..65a3918c 100644
--- a/Cryptlib/Makefile
+++ b/Cryptlib/Makefile
@@ -2,8 +2,14 @@ ifneq ($(CCACHE_DISABLE),)
 export CCACHE_DISABLE
 endif
 
-INCLUDES	= -I$(TOPDIR) -iquote $(TOPDIR) -I$(TOPDIR)/Include \
-		  $(EFI_INCLUDES) -I$(shell $(CC) -print-file-name=include)
+CRYPTDIR	= $(TOPDIR)/Cryptlib
+
+FEATUREFLAGS	+= -nostdinc
+
+INCLUDES	= -I$(CRYPTDIR) -I$(CRYPTDIR)/Include \
+		  $(EFI_INCLUDES) \
+		  -isystem $(TOPDIR)/include/system \
+		  -isystem $(shell $(CC) -print-file-name=include)
 
 CFLAGS		= $(FEATUREFLAGS) \
 		  $(OPTIMIZATIONS) \
@@ -15,12 +21,12 @@ CFLAGS		= $(FEATUREFLAGS) \
 CLANG_BUGS	= $(if $(findstring gcc,$(CC)),-maccumulate-outgoing-args,)
 
 ifeq ($(ARCH),x86_64)
-FEATUREFLAGS	+= -m64 -mno-mmx -mno-sse -mno-red-zone -nostdinc $(CLANG_BUGS)
+FEATUREFLAGS	+= -m64 -mno-mmx -mno-sse -mno-red-zone $(CLANG_BUGS)
 DEFINES		+= -DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI \
 		   -DNO_BUILTIN_VA_FUNCS -DMDE_CPU_X64
 endif
 ifeq ($(ARCH),ia32)
-FEATUREFLAGS	+= -m32 -mno-mmx -mno-sse -mno-red-zone -nostdinc $(CLANG_BUGS)
+FEATUREFLAGS	+= -m32 -mno-mmx -mno-sse -mno-red-zone $(CLANG_BUGS)
 DEFINES		+= -DMDE_CPU_IA32
 endif
 ifeq ($(ARCH),aarch64)
diff --git a/Cryptlib/OpenSSL/Makefile b/Cryptlib/OpenSSL/Makefile
index 5bd72481..294e889a 100644
--- a/Cryptlib/OpenSSL/Makefile
+++ b/Cryptlib/OpenSSL/Makefile
@@ -2,17 +2,23 @@ ifneq ($(CCACHE_DISABLE),)
 export CCACHE_DISABLE
 endif
 
+CRYPTDIR	= $(TOPDIR)/Cryptlib
+OSSLDIR		= $(TOPDIR)/Cryptlib/OpenSSL
+
 DEFINES		= -DL_ENDIAN \
 		  -D_CRT_SECURE_NO_DEPRECATE \
 		  -D_CRT_NONSTDC_NO_DEPRECATE \
 		  -DOPENSSL_SMALL_FOOTPRINT \
 		  -DPEDANTIC
 
-INCLUDES	= -I$(TOPDIR) -I$(TOPDIR)/.. -I$(TOPDIR)/../Include/ -I$(TOPDIR)/crypto \
-		  -I$(shell $(CC) -print-file-name=include) \
-		  -I$(TOPDIR)/../Include $(EFI_INCLUDES) \
-		  -I$(TOPDIR)/crypto/asn1 -I$(TOPDIR)/crypto/evp \
-		  -I$(TOPDIR)/crypto/modes -I$(TOPDIR)/crypto/include
+INCLUDES	= -I$(OSSLDIR) -I$(CRYPTDIR) -I$(OSSLDIR)/Include/ \
+		  -I$(OSSLDIR)/crypto -I$(CRYPTDIR)/Include $(EFI_INCLUDES) \
+		  -I$(OSSLDIR)/crypto/asn1 -I$(OSSLDIR)/crypto/evp \
+		  -I$(OSSLDIR)/crypto/modes -I$(OSSLDIR)/crypto/include \
+		  -isystem $(TOPDIR)/include/system \
+		  -isystem $(shell $(CC) -print-file-name=include)
+
+FEATUREFLAGS	+= -nostdinc
 
 WERRFLAGS	+= -Wno-error=discarded-qualifiers \
 		   -Wno-error=maybe-uninitialized \
diff --git a/Cryptlib/OpenSSL/crypto/bio/b_print.c b/Cryptlib/OpenSSL/crypto/bio/b_print.c
index fea73864..2d303ee8 100644
--- a/Cryptlib/OpenSSL/crypto/bio/b_print.c
+++ b/Cryptlib/OpenSSL/crypto/bio/b_print.c
@@ -134,9 +134,9 @@ static int fmtfp(char **, char **, size_t *, size_t *,
                  LDOUBLE, int, int, int);
 #endif
 static int doapr_outch(char **, char **, size_t *, size_t *, int);
-static int _dopr(char **sbuffer, char **buffer,
-                 size_t *maxlen, size_t *retlen, int *truncated,
-                 const char *format, va_list args);
+static int EFIAPI _dopr(char **sbuffer, char **buffer,
+			size_t *maxlen, size_t *retlen, int *truncated,
+			const char *format, va_list args);
 
 /* format read states */
 #define DP_S_DEFAULT    0
@@ -167,7 +167,7 @@ static int _dopr(char **sbuffer, char **buffer,
 #define char_to_int(p) (p - '0')
 #define OSSL_MAX(p,q) ((p >= q) ? p : q)
 
-static int
+static int EFIAPI
 _dopr(char **sbuffer,
       char **buffer,
       size_t *maxlen,
diff --git a/Make.defaults b/Make.defaults
index bef3cb51..ebb9e3c3 100644
--- a/Make.defaults
+++ b/Make.defaults
@@ -102,7 +102,8 @@ INCLUDES	= -nostdinc \
 		  -I$(shell $(CC) $(ARCH_CFLAGS) -print-file-name=include) \
 		  -I$(TOPDIR)/Cryptlib -I$(TOPDIR)/Cryptlib/Include \
 		  -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH_GNUEFI) -I$(EFI_INCLUDE)/protocol \
-		  -I$(TOPDIR)/include -iquote $(TOPDIR) -iquote $(shell pwd)
+		  -I$(TOPDIR)/include -iquote $(TOPDIR) -iquote $(shell pwd) \
+		  -isystem $(TOPDIR)/include/system
 
 override DEFAULT_FEATUREFLAGS = \
 		-std=gnu11 \
diff --git a/Makefile b/Makefile
index c1d13947..6a62e00a 100644
--- a/Makefile
+++ b/Makefile
@@ -16,6 +16,7 @@ override TOPDIR := $(shell pwd)
 endif
 override TOPDIR	:= $(abspath $(TOPDIR))
 VPATH		= $(TOPDIR)
+export TOPDIR
 
 include $(TOPDIR)/Make.rules
 include $(TOPDIR)/Make.defaults
@@ -134,15 +135,15 @@ gnu-efi/$(ARCH_GNUEFI)/gnuefi/libgnuefi.a gnu-efi/$(ARCH_GNUEFI)/lib/libefi.a:
 
 Cryptlib/libcryptlib.a:
 	for i in Hash Hmac Cipher Rand Pk Pem SysCall; do mkdir -p Cryptlib/$$i; done
-	$(MAKE) VPATH=$(TOPDIR)/Cryptlib TOPDIR=$(TOPDIR)/Cryptlib -C Cryptlib -f $(TOPDIR)/Cryptlib/Makefile
+	$(MAKE) VPATH=$(TOPDIR)/Cryptlib -C Cryptlib -f $(TOPDIR)/Cryptlib/Makefile
 
 Cryptlib/OpenSSL/libopenssl.a:
 	for i in x509v3 x509 txt_db stack sha rsa rc4 rand pkcs7 pkcs12 pem ocsp objects modes md5 lhash kdf hmac evp err dso dh conf comp cmac buffer bn bio async/arch asn1 aes; do mkdir -p Cryptlib/OpenSSL/crypto/$$i; done
-	$(MAKE) VPATH=$(TOPDIR)/Cryptlib/OpenSSL TOPDIR=$(TOPDIR)/Cryptlib/OpenSSL -C Cryptlib/OpenSSL -f $(TOPDIR)/Cryptlib/OpenSSL/Makefile
+	$(MAKE) VPATH=$(TOPDIR)/Cryptlib/OpenSSL -C Cryptlib/OpenSSL -f $(TOPDIR)/Cryptlib/OpenSSL/Makefile
 
 lib/lib.a: | $(TOPDIR)/lib/Makefile $(wildcard $(TOPDIR)/include/*.[ch])
 	if [ ! -d lib ]; then mkdir lib ; fi
-	$(MAKE) VPATH=$(TOPDIR)/lib TOPDIR=$(TOPDIR) CFLAGS="$(CFLAGS)" -C lib -f $(TOPDIR)/lib/Makefile lib.a
+	$(MAKE) VPATH=$(TOPDIR)/lib -C lib -f $(TOPDIR)/lib/Makefile lib.a
 
 buildid : $(TOPDIR)/buildid.c
 	$(CC) -Og -g3 -Wall -Werror -Wextra -o $@ $< -lelf
diff --git a/MokManager.c b/MokManager.c
index 5a851d86..cd1492f8 100644
--- a/MokManager.c
+++ b/MokManager.c
@@ -1,18 +1,12 @@
 // SPDX-License-Identifier: BSD-2-Clause-Patent
+#include "shim.h"
 
-#include <efi.h>
-#include <efilib.h>
-#include <stdarg.h>
 #include <Library/BaseCryptLib.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 #include <openssl/asn1.h>
 #include <openssl/bn.h>
 
-#include "shim.h"
-
-#include "hexdump.h"
-
 #define PASSWORD_MAX 256
 #define PASSWORD_MIN 1
 #define SB_PASSWORD_LEN 16
diff --git a/PasswordCrypt.c b/PasswordCrypt.c
index 311c914b..1030a6dd 100644
--- a/PasswordCrypt.c
+++ b/PasswordCrypt.c
@@ -1,13 +1,11 @@
 // SPDX-License-Identifier: BSD-2-Clause-Patent
 
-#include <efi.h>
-#include <efilib.h>
+#include "shim.h"
+
 #include <Library/BaseCryptLib.h>
 #include <openssl/sha.h>
 #include <openssl/md5.h>
 
-#include "shim.h"
-
 #define TRAD_DES_HASH_SIZE 13 /* (64/6+1) + (12/6) */
 #define BSDI_DES_HASH_SIZE 20 /* (64/6+1) + (24/6) + 4 + 1 */
 #define BLOWFISH_HASH_SIZE 31 /* 184/6+1 */
diff --git a/crypt_blowfish.c b/crypt_blowfish.c
index 7a474f26..b1eb0e60 100644
--- a/crypt_blowfish.c
+++ b/crypt_blowfish.c
@@ -43,11 +43,6 @@
  * Blowfish library (I can't be sure if I would think of something if I
  * hadn't seen his code).
  */
-
-#include <efi.h>
-#include <efilib.h>
-
-/* Just to make sure the prototypes match the actual definitions */
 #include "shim.h"
 
 typedef unsigned int BF_word;
diff --git a/errlog.c b/errlog.c
index 714d09d3..16af23b0 100644
--- a/errlog.c
+++ b/errlog.c
@@ -5,30 +5,29 @@
  */
 
 #include "shim.h"
-#include "hexdump.h"
 
 static CHAR16 **errs = NULL;
 static UINTN nerrs = 0;
 
-EFI_STATUS
-vdprint_(const CHAR16 *fmt, const char *file, int line, const char *func, va_list args)
+EFI_STATUS EFIAPI
+vdprint_(const CHAR16 *fmt, const char *file, int line, const char *func, elf_va_list args)
 {
-	va_list args2;
+	elf_va_list args2;
 	EFI_STATUS efi_status = EFI_SUCCESS;
 
 	if (verbose) {
-		va_copy(args2, args);
+		elf_va_copy(args2, args);
 		console_print(L"%a:%d:%a() ", file, line, func);
 		efi_status = VPrint(fmt, args2);
-		va_end(args2);
+		elf_va_end(args2);
 	}
 	return efi_status;
 }
 
-EFI_STATUS
-VLogError(const char *file, int line, const char *func, const CHAR16 *fmt, va_list args)
+EFI_STATUS EFIAPI
+VLogError(const char *file, int line, const char *func, const CHAR16 *fmt, elf_va_list args)
 {
-	va_list args2;
+	elf_va_list args2;
 	CHAR16 **newerrs;
 
 	newerrs = ReallocatePool(errs, (nerrs + 1) * sizeof(*errs),
@@ -39,11 +38,11 @@ VLogError(const char *file, int line, const char *func, const CHAR16 *fmt, va_li
 	newerrs[nerrs] = PoolPrint(L"%a:%d %a() ", file, line, func);
 	if (!newerrs[nerrs])
 		return EFI_OUT_OF_RESOURCES;
-	va_copy(args2, args);
+	elf_va_copy(args2, args);
 	newerrs[nerrs+1] = VPoolPrint(fmt, args2);
 	if (!newerrs[nerrs+1])
 		return EFI_OUT_OF_RESOURCES;
-	va_end(args2);
+	elf_va_end(args2);
 
 	nerrs += 2;
 	newerrs[nerrs] = NULL;
@@ -52,15 +51,15 @@ VLogError(const char *file, int line, const char *func, const CHAR16 *fmt, va_li
 	return EFI_SUCCESS;
 }
 
-EFI_STATUS
+EFI_STATUS EFIAPI
 LogError_(const char *file, int line, const char *func, const CHAR16 *fmt, ...)
 {
-	va_list args;
+	elf_va_list args;
 	EFI_STATUS efi_status;
 
-	va_start(args, fmt);
+	elf_va_start(args, fmt);
 	efi_status = VLogError(file, line, func, fmt, args);
-	va_end(args);
+	elf_va_end(args);
 
 	return efi_status;
 }
diff --git a/fallback.c b/fallback.c
index fc81c5e4..ba90bb3b 100644
--- a/fallback.c
+++ b/fallback.c
@@ -3,10 +3,6 @@
  * Copyright Red Hat, Inc.
  * Copyright Peter Jones <pjones@redhat.com>
  */
-
-#include <efi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 #define NO_REBOOT L"FB_NO_REBOOT"
diff --git a/httpboot.c b/httpboot.c
index bedb99d2..fe08f3f7 100644
--- a/httpboot.c
+++ b/httpboot.c
@@ -7,10 +7,6 @@
  * (http://tianocore.sf.net) and are Copyright 2009-2012 Intel
  * Corporation.
  */
-
-#include <efi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 static UINTN
diff --git a/include/console.h b/include/console.h
index b2ab5fe4..d8af3cd3 100644
--- a/include/console.h
+++ b/include/console.h
@@ -17,9 +17,9 @@
 
 EFI_STATUS
 console_get_keystroke(EFI_INPUT_KEY *key);
-UINTN
+UINTN EFIAPI
 console_print(const CHAR16 *fmt, ...);
-UINTN
+UINTN EFIAPI
 console_print_at(UINTN col, UINTN row, const CHAR16 *fmt, ...);
 void
 console_print_box_at(CHAR16 *str_arr[], int highlight,
@@ -101,8 +101,8 @@ extern UINT32 verbose;
 #define dprint(fmt, ...)                                              \
 	dprint_(L"%a:%d:%a() " fmt, __FILE__, __LINE__ - 1, __func__, \
 	        ##__VA_ARGS__)
-extern EFI_STATUS
-vdprint_(const CHAR16 *fmt, const char *file, int line, const char *func, va_list args);
+extern EFI_STATUS EFIAPI vdprint_(const CHAR16 *fmt, const char *file, int line,
+                                  const char *func, elf_va_list args);
 #define vdprint(fmt, ...) \
 	vdprint_(fmt, __FILE__, __LINE__ - 1, __func__, ##__VA_ARGS__)
 
diff --git a/include/hexdump.h b/include/hexdump.h
index 8b8b4557..36d77ec4 100644
--- a/include/hexdump.h
+++ b/include/hexdump.h
@@ -3,7 +3,8 @@
 #ifndef STATIC_HEXDUMP_H
 #define STATIC_HEXDUMP_H
 
-#include <stdint.h>
+#include "shim.h"
+#include "include/console.h"
 
 static inline unsigned long UNUSED
 prepare_hex(const void *data, size_t size, char *buf, unsigned int position)
@@ -80,8 +81,9 @@ prepare_text(const void *data, size_t size, char *buf, unsigned int position)
  * variadic hexdump formatted
  * think of it as: printf("%s%s\n", vformat(fmt, ap), hexdump(data,size));
  */
-static inline void UNUSED
-vhexdumpf(const char *file, int line, const char *func, const CHAR16 * const fmt, const void *data, unsigned long size, size_t at, va_list ap)
+static inline void UNUSED EFIAPI
+vhexdumpf(const char *file, int line, const char *func, const CHAR16 *const fmt,
+          const void *data, unsigned long size, size_t at, elf_va_list ap)
 {
 	unsigned long display_offset = at;
 	unsigned long offset = 0;
@@ -115,13 +117,14 @@ vhexdumpf(const char *file, int line, const char *func, const CHAR16 * const fmt
  * think of it as: printf("%s%s", format(fmt, ...), hexdump(data,size)[lineN]);
  */
 static inline void UNUSED
-hexdumpf(const char *file, int line, const char *func, const CHAR16 * const fmt, const void *data, unsigned long size, size_t at, ...)
+hexdumpf(const char *file, int line, const char *func, const CHAR16 *const fmt,
+         const void *data, unsigned long size, size_t at, ...)
 {
-	va_list ap;
+	elf_va_list ap;
 
-	va_start(ap, at);
+	elf_va_start(ap, at);
 	vhexdumpf(file, line, func, fmt, data, size, at, ap);
-	va_end(ap);
+	elf_va_end(ap);
 }
 
 static inline void UNUSED
diff --git a/include/system/alloca.h b/include/system/alloca.h
new file mode 100644
index 00000000..dc11b60d
--- /dev/null
+++ b/include/system/alloca.h
@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+#ifdef SHIM_UNIT_TEST
+#include_next <alloca.h>
+#else
+#ifndef _ALLOCA_H
+#define _ALLOCA_H
+
+#endif /* !_ALLOCA_H */
+#endif
+// vim:fenc=utf-8:tw=75:noet
diff --git a/include/system/ctype.h b/include/system/ctype.h
new file mode 100644
index 00000000..c771bb69
--- /dev/null
+++ b/include/system/ctype.h
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+/*
+ * ctype.h - standard ctype functions
+ */
+#ifdef SHIM_UNIT_TEST
+#include_next <string.h>
+#else
+#ifndef _CTYPE_H
+#define _CTYPE_H
+
+
+#endif /* !_CTYPE_H */
+#endif /* !SHIM_UNIT_TEST */
+// vim:fenc=utf-8:tw=75:noet
diff --git a/include/system/inttypes.h b/include/system/inttypes.h
new file mode 100644
index 00000000..a35b0090
--- /dev/null
+++ b/include/system/inttypes.h
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+#ifdef SHIM_UNIT_TEST
+#include_next <inttypes.h>
+#else
+#ifndef _INTTYPES_H
+#define _INTTYPES_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#endif /* !INTTYPES_H_ */
+#endif
+// vim:fenc=utf-8:tw=75:noet
diff --git a/include/system/stdarg.h b/include/system/stdarg.h
new file mode 100644
index 00000000..346b760d
--- /dev/null
+++ b/include/system/stdarg.h
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+/*
+ * stdarg.h - try to make consistent va_* handling for EFI
+ */
+#ifdef SHIM_UNIT_TEST
+#include_next <stdarg.h>
+#else
+#ifndef _STDARG_H
+#define _STDARG_H
+
+#include <efistdarg.h>
+
+#endif /* !_STDARG_H */
+#endif
+#ifndef SHIM_STDARG_H_
+#define SHIM_STDARG_H_
+
+typedef __builtin_ms_va_list ms_va_list;
+#define ms_va_copy(dest, start)  __builtin_ms_va_copy(dest, start)
+#define ms_va_start(marker, arg) __builtin_ms_va_start(marker, arg)
+#define ms_va_arg(marker, type)  __builtin_va_arg(marker, type)
+#define ms_va_end(marker)        __builtin_ms_va_end(marker)
+
+typedef __builtin_va_list elf_va_list;
+#define elf_va_copy(dest, start)  __builtin_va_copy(dest, start)
+#define elf_va_start(marker, arg) __builtin_va_start(marker, arg)
+#define elf_va_arg(marker, type)  __builtin_va_arg(marker, type)
+#define elf_va_end(marker)        __builtin_va_end(marker)
+
+#endif /* !SHIM_STDARG_H_ */
+// vim:fenc=utf-8:tw=75:noet
diff --git a/include/system/stdio.h b/include/system/stdio.h
new file mode 100644
index 00000000..6ea60d71
--- /dev/null
+++ b/include/system/stdio.h
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+/*
+ * stdio.h - sigh
+ */
+#ifdef SHIM_UNIT_TEST
+#include_next <stdio.h>
+#else
+#ifndef _STDIO_H
+#define _STDIO_H
+
+#endif /* !_STDIO_H */
+#endif
+// vim:fenc=utf-8:tw=75:noet
diff --git a/include/system/stdlib.h b/include/system/stdlib.h
new file mode 100644
index 00000000..f2660f63
--- /dev/null
+++ b/include/system/stdlib.h
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+#ifdef SHIM_UNIT_TEST
+#include_next <stdlib.h>
+#else
+#ifndef _STDLIB_H
+#define _STDLIB_H
+
+/*
+ * I don't know why, but openssl expects to get size_t from stdlib.h
+ * instead of stddef.h, so... whatever.
+ */
+#include <stddef.h>
+
+#endif /* !_STDLIB_H */
+#endif
+// vim:fenc=utf-8:tw=75:noet
diff --git a/include/system/string.h b/include/system/string.h
new file mode 100644
index 00000000..21e46c1d
--- /dev/null
+++ b/include/system/string.h
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+#ifdef SHIM_UNIT_TEST
+#include_next <string.h>
+#else
+#ifndef _STRING_H
+#define _STRING_H
+
+#include <stddef.h>
+
+__typeof__(__builtin_memset) memset;
+__typeof__(__builtin_memcpy) memcpy;
+
+#endif /* _STRING_H */
+#endif
diff --git a/include/system/strings.h b/include/system/strings.h
new file mode 100644
index 00000000..c82bd917
--- /dev/null
+++ b/include/system/strings.h
@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+#ifdef SHIM_UNIT_TEST
+#include_next <strings.h>
+#else
+#ifndef _STRINGS_H
+#define _STRINGS_H
+
+#endif /* !_STRINGS_H */
+#endif
+// vim:fenc=utf-8:tw=75:noet
diff --git a/include/test.h b/include/test.h
index 6fc178ba..8a970fd2 100644
--- a/include/test.h
+++ b/include/test.h
@@ -11,13 +11,13 @@
 #include <stdarg.h>
 
 #if defined(__aarch64__)
-#include <aa64/efibind.h>
+#include <aarch64/efibind.h>
 #elif defined(__arm__)
 #include <arm/efibind.h>
 #elif defined(__i386__) || defined(__i486__) || defined(__i686__)
 #include <ia32/efibind.h>
 #elif defined(__x86_64__)
-#include <x64/efibind.h>
+#include <x86_64/efibind.h>
 #else
 #error what arch is this
 #endif
diff --git a/lib/Makefile b/lib/Makefile
index d9188c74..63893c3e 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -2,9 +2,44 @@ TARGET = lib.a
 
 LIBFILES = $(foreach x,$(wildcard *.c),$(patsubst %.c,%.o,$(x)))
 
+CRYPTDIR	= $(TOPDIR)/Cryptlib
+
 INCLUDES	= $(EFI_INCLUDES) \
-		  -I$(TOPDIR)/../include \
-		  -I$(TOPDIR)/CryptLib/Include/openssl/
+		  -I$(TOPDIR)/include \
+		  -I$(CRYPTDIR)/Include/openssl/ \
+		  -I$(CRYPTDIR)/Include/ \
+		  -I$(CRYPTDIR) \
+		  -I$(TOPDIR) \
+		  -isystem $(TOPDIR)/include/system \
+		  -isystem $(shell $(CC) -print-file-name=include)
+
+CLANG_BUGS	= $(if $(findstring gcc,$(CC)),-maccumulate-outgoing-args,)
+
+ifeq ($(ARCH),x86_64)
+FEATUREFLAGS	+= -m64 -mno-mmx -mno-sse -mno-red-zone -nostdinc $(CLANG_BUGS)
+DEFINES		+= -DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI \
+		   -UNO_BUILTIN_VA_FUNCS -DMDE_CPU_X64
+endif
+ifeq ($(ARCH),ia32)
+FEATUREFLAGS	+= -m32 -mno-mmx -mno-sse -mno-red-zone -nostdinc $(CLANG_BUGS)
+DEFINES		+= -DMDE_CPU_IA32
+endif
+ifeq ($(ARCH),aarch64)
+DEFINES		+= -DMDE_CPU_AARCH64
+endif
+ifeq ($(ARCH),arm)
+DEFINES		+= -DMDE_CPU_ARM
+endif
+
+LDFLAGS		= -nostdlib -znocombreloc
+
+
+CFLAGS		= $(FEATUREFLAGS) \
+		  $(OPTIMIZATIONS) \
+		  $(WARNFLAGS) \
+		  $(WERRFLAGS) \
+		  $(INCLUDES) \
+		  $(DEFINES)
 
 lib.a: $(LIBFILES)
 	$(AR) rcs lib.a $(LIBFILES)
diff --git a/lib/configtable.c b/lib/configtable.c
index 8675fad1..66e97f63 100644
--- a/lib/configtable.c
+++ b/lib/configtable.c
@@ -4,9 +4,6 @@
  *
  * read some platform configuration tables
  */
-#include <efi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 void *
diff --git a/lib/console.c b/lib/console.c
index ffa8ea5c..32c6d55d 100644
--- a/lib/console.c
+++ b/lib/console.c
@@ -3,11 +3,6 @@
  * Copyright 2012 <James.Bottomley@HansenPartnership.com>
  * Copyright 2013 Red Hat Inc. <pjones@redhat.com>
  */
-#include <efi.h>
-#include <efilib.h>
-#include <stdarg.h>
-#include <stdbool.h>
-
 #include "shim.h"
 
 static UINT8 console_text_mode = 0;
@@ -88,27 +83,27 @@ VOID console_fini(VOID)
 		setup_console(0);
 }
 
-UINTN
+UINTN EFIAPI
 console_print(const CHAR16 *fmt, ...)
 {
-	va_list args;
+	elf_va_list args;
 	UINTN ret;
 
 	if (!console_text_mode)
 		setup_console(1);
 
-	va_start(args, fmt);
+	elf_va_start(args, fmt);
 	ret = VPrint(fmt, args);
-	va_end(args);
+	elf_va_end(args);
 
 	return ret;
 }
 
-UINTN
+UINTN EFIAPI
 console_print_at(UINTN col, UINTN row, const CHAR16 *fmt, ...)
 {
 	SIMPLE_TEXT_OUTPUT_INTERFACE *co = ST->ConOut;
-	va_list args;
+	elf_va_list args;
 	UINTN ret;
 
 	if (!console_text_mode)
@@ -116,9 +111,9 @@ console_print_at(UINTN col, UINTN row, const CHAR16 *fmt, ...)
 
 	co->SetCursorPosition(co, col, row);
 
-	va_start(args, fmt);
+	elf_va_start(args, fmt);
 	ret = VPrint(fmt, args);
-	va_end(args);
+	elf_va_end(args);
 
 	return ret;
 }
diff --git a/lib/execute.c b/lib/execute.c
index f57a6321..642f94a3 100644
--- a/lib/execute.c
+++ b/lib/execute.c
@@ -3,10 +3,6 @@
  * Copyright 2012 <James.Bottomley@HansenPartnership.com>
  * Code Copyright 2012 Red Hat, Inc <mjg@redhat.com>
  */
-
-#include <efi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 EFI_STATUS
diff --git a/lib/print_crypto.c b/lib/print_crypto.c
index 39dfd2c0..ccdb65b1 100644
--- a/lib/print_crypto.c
+++ b/lib/print_crypto.c
@@ -2,11 +2,6 @@
 /*
  * Copyright 2019 SUSE LLC <glin@suse.com>
  */
-
-#include <efi.h>
-#include <efilib.h>
-#include <stdarg.h>
-
 #include "shim.h"
 
 #include <Library/BaseCryptLib.h>
diff --git a/lib/security_policy.c b/lib/security_policy.c
index 6a9b13ed..6c42cc14 100644
--- a/lib/security_policy.c
+++ b/lib/security_policy.c
@@ -4,10 +4,6 @@
  *
  * Install and remove a platform security2 override policy
  */
-
-#include <efi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 #if defined(OVERRIDE_SECURITY_POLICY)
diff --git a/lib/shell.c b/lib/shell.c
index 87f279d6..146d9a21 100644
--- a/lib/shell.c
+++ b/lib/shell.c
@@ -4,9 +4,6 @@
  *
  * misc shell helper functions
  */
-#include <efi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 EFI_STATUS
diff --git a/lib/simple_file.c b/lib/simple_file.c
index e6544709..5fd3e1a6 100644
--- a/lib/simple_file.c
+++ b/lib/simple_file.c
@@ -2,10 +2,6 @@
 /*
  * Copyright 2012 <James.Bottomley@HansenPartnership.com>
  */
-
-#include <efi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 EFI_STATUS
diff --git a/lib/variables.c b/lib/variables.c
index 6db069ef..57875e26 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -10,9 +10,6 @@
  * Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>
  *
  */
-#include <efi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 EFI_STATUS
diff --git a/mok.c b/mok.c
index ac0276ec..6bd506be 100644
--- a/mok.c
+++ b/mok.c
@@ -6,10 +6,6 @@
 
 #include "shim.h"
 
-#include <stdint.h>
-
-#include "hexdump.h"
-
 /*
  * Check if a variable exists
  */
diff --git a/netboot.c b/netboot.c
index 25a6df7f..450e9def 100644
--- a/netboot.c
+++ b/netboot.c
@@ -13,8 +13,6 @@
 
 #include "shim.h"
 
-#include <string.h>
-
 #define ntohs(x) __builtin_bswap16(x)	/* supported both by GCC and clang */
 #define htons(x) ntohs(x)
 
diff --git a/pe.c b/pe.c
index 45dd4714..73b05a51 100644
--- a/pe.c
+++ b/pe.c
@@ -5,7 +5,6 @@
  */
 
 #include "shim.h"
-#include "hexdump.h"
 
 #include <openssl/err.h>
 #include <openssl/bn.h>
diff --git a/replacements.c b/replacements.c
index 69dbd5a2..278a8e78 100644
--- a/replacements.c
+++ b/replacements.c
@@ -18,11 +18,6 @@
  *      National Security Policy and Scientific Developments, November 20,
  *      1969.
  */
-
-#include <efi.h>
-#include <efiapi.h>
-#include <efilib.h>
-
 #include "shim.h"
 
 static EFI_SYSTEM_TABLE *systab;
diff --git a/sbat.c b/sbat.c
index f46bb8ab..d8750962 100644
--- a/sbat.c
+++ b/sbat.c
@@ -4,7 +4,6 @@
  */
 
 #include "shim.h"
-#include "string.h"
 
 EFI_STATUS
 parse_sbat_section(char *section_base, size_t section_size,
diff --git a/shim.c b/shim.c
index 32bc3e81..6f627b1f 100644
--- a/shim.c
+++ b/shim.c
@@ -12,7 +12,6 @@
  */
 
 #include "shim.h"
-#include "hexdump.h"
 #if defined(ENABLE_SHIM_CERT)
 #include "shim_cert.h"
 #endif /* defined(ENABLE_SHIM_CERT) */
diff --git a/shim.h b/shim.h
index d28e16b7..61dafa82 100644
--- a/shim.h
+++ b/shim.h
@@ -26,6 +26,14 @@
 #endif
 #endif
 
+#include <ctype.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <system/stdarg.h>
+#include <string.h>
+#include <strings.h>
+
 #ifndef SHIM_UNIT_TEST
 #include <efi.h>
 #include <efilib.h>
@@ -34,9 +42,6 @@
 #include <efiip.h>
 #endif
 
-#include <stddef.h>
-#include <stdint.h>
-
 #ifdef SHIM_UNIT_TEST
 #include "include/test.h"
 #endif
@@ -158,9 +163,14 @@
 #include "include/tpm.h"
 #include "include/ucs2.h"
 #include "include/variables.h"
+#include "include/hexdump.h"
 
 #include "version.h"
 
+#ifndef SHIM_UNIT_TEST
+#include "Cryptlib/Include/OpenSslSupport.h"
+#endif
+
 INTERFACE_DECL(_SHIM_LOCK);
 
 typedef
@@ -196,9 +206,12 @@ typedef struct _SHIM_LOCK {
 
 extern EFI_STATUS shim_init(void);
 extern void shim_fini(void);
-extern EFI_STATUS LogError_(const char *file, int line, const char *func, const CHAR16 *fmt, ...);
-extern EFI_STATUS VLogError(const char *file, int line, const char *func, const CHAR16 *fmt, va_list args);
-extern VOID LogHexdump_(const char *file, int line, const char *func, const void *data, size_t sz);
+extern EFI_STATUS EFIAPI LogError_(const char *file, int line, const char *func,
+                                   const CHAR16 *fmt, ...);
+extern EFI_STATUS EFIAPI VLogError(const char *file, int line, const char *func,
+                                   const CHAR16 *fmt, elf_va_list args);
+extern VOID LogHexdump_(const char *file, int line, const char *func,
+                        const void *data, size_t sz);
 extern VOID PrintErrors(VOID);
 extern VOID ClearErrors(VOID);
 extern VOID restore_loaded_image(VOID);
diff --git a/test.c b/test.c
index b21e2191..aa0da1fd 100644
--- a/test.c
+++ b/test.c
@@ -12,7 +12,8 @@
 UINT8 in_protocol = 0;
 int debug = DEFAULT_DEBUG_PRINT_STATE;
 
-EFI_STATUS LogError_(const char *file, int line, const char *func, const CHAR16 *fmt, ...)
+EFI_STATUS EFIAPI
+LogError_(const char *file, int line, const char *func, const CHAR16 *fmt, ...)
 {
 	assert(0);
 	return EFI_SUCCESS;
diff --git a/tpm.c b/tpm.c
index e1fcb8be..808e0444 100644
--- a/tpm.c
+++ b/tpm.c
@@ -1,10 +1,4 @@
 // SPDX-License-Identifier: BSD-2-Clause-Patent
-
-#include <efi.h>
-#include <efilib.h>
-#include <string.h>
-#include <stdint.h>
-
 #include "shim.h"
 
 typedef struct {
-- 
cgit v1.2.3


From ed6265c567f7e5aaa0d326e8a5fc21f3499f3ffc Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Thu, 11 Mar 2021 11:30:14 -0500
Subject: get_variable_attr(): fix a nit scan-build found.

scan-build believes we can hit a situation where get_variable_attr() is
called with NULL data, in which case we're not correctly returning an
error.

This adds the error return.

Signed-off-by: Peter Jones <pjones@redhat.com>
---
 lib/variables.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lib/variables.c')

diff --git a/lib/variables.c b/lib/variables.c
index 57875e26..9f5b2b57 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -224,6 +224,9 @@ get_variable_attr(const CHAR16 * const var, UINT8 **data, UINTN *len,
 {
 	EFI_STATUS efi_status;
 
+	if (!len)
+		return EFI_INVALID_PARAMETER;
+
 	*len = 0;
 
 	efi_status = gRT->GetVariable((CHAR16 *)var, &owner, NULL, len, NULL);
@@ -233,6 +236,9 @@ get_variable_attr(const CHAR16 * const var, UINT8 **data, UINTN *len,
 		return efi_status;
 	}
 
+	if (!data)
+		return EFI_INVALID_PARAMETER;
+
 	/*
 	 * Add three zero pad bytes; at least one correctly aligned UCS-2
 	 * character.
-- 
cgit v1.2.3


From 3dd40ade68c6ff63e776b5f9acbd811a3c345d01 Mon Sep 17 00:00:00 2001
From: Chris Coulson <chris.coulson@canonical.com>
Date: Thu, 18 Mar 2021 14:32:24 +0000
Subject: Ensure that MOK variable mirroring creates well formed ESLs

The MOK variable mirroring makes use of variable_create_esl, which
can only create a well-formed EFI_SIGNATURE_LIST containing a single
signature. Fix fill_esl and variable_create_esl to support creating
a EFI_SIGNATURE_LIST with one or more supplied EFI_SIGNATURE_DATA
structures.

Introduce variable_create_esl_with_one_signature and
fill_esl_with_one_signature for code that does want to create a
EFI_SIGNATURE_LIST containing a single signature constructed from
a supplied signature data buffer and owner GUID.
---
 include/variables.h | 16 ++++++++---
 lib/variables.c     | 81 +++++++++++++++++++++++++++++++++++++++++++----------
 mok.c               | 56 ++++++++++++++++++------------------
 3 files changed, 106 insertions(+), 47 deletions(-)

(limited to 'lib/variables.c')

diff --git a/include/variables.h b/include/variables.h
index 31cfcb65..493f433f 100644
--- a/include/variables.h
+++ b/include/variables.h
@@ -64,12 +64,20 @@ EFI_STATUS
 variable_enroll_hash(const CHAR16 * const var, EFI_GUID owner,
 		     UINT8 hash[SHA256_DIGEST_SIZE]);
 EFI_STATUS
-variable_create_esl(const uint8_t *cert, const size_t cert_len,
-		    const EFI_GUID *type, const EFI_GUID *owner,
+variable_create_esl(const EFI_SIGNATURE_DATA *first_sig, const size_t howmany,
+		    const EFI_GUID *type, const UINT32 sig_size,
 		    uint8_t **out, size_t *outlen);
 EFI_STATUS
-fill_esl(const uint8_t *data, const size_t data_len,
-	 const EFI_GUID *type, const EFI_GUID *owner,
+variable_create_esl_with_one_signature(const uint8_t* data, const size_t data_len,
+				       const EFI_GUID *type, const EFI_GUID *owner,
+				       uint8_t **out, size_t *outlen);
+EFI_STATUS
+fill_esl(const EFI_SIGNATURE_DATA *first_sig, const size_t howmany,
+	 const EFI_GUID *type, const UINT32 sig_size,
 	 uint8_t *out, size_t *outlen);
+EFI_STATUS
+fill_esl_with_one_signature(const uint8_t *data, const uint32_t data_len,
+			    const EFI_GUID *type, const EFI_GUID *owner,
+			    uint8_t *out, size_t *outlen);
 
 #endif /* SHIM_VARIABLES_H */
diff --git a/lib/variables.c b/lib/variables.c
index 9f5b2b57..53a5d14a 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -13,18 +13,24 @@
 #include "shim.h"
 
 EFI_STATUS
-fill_esl(const uint8_t *data, const size_t data_len,
-	 const EFI_GUID *type, const EFI_GUID *owner,
+fill_esl(const EFI_SIGNATURE_DATA *first_sig, const size_t howmany,
+	 const EFI_GUID *type, const UINT32 sig_size,
 	 uint8_t *out, size_t *outlen)
 {
 	EFI_SIGNATURE_LIST *sl;
 	EFI_SIGNATURE_DATA *sd;
 	size_t needed = 0;
+	size_t data_len = howmany * sig_size;
 
-	if (!data || !data_len || !type || !outlen)
+	dprint(L"fill_esl: data=%p, data_len=%lu", first_sig, data_len);
+
+	if ((out && !first_sig) || !howmany || !type || !sig_size || !outlen)
+		return EFI_INVALID_PARAMETER;
+
+	if (howmany > (UINT32_MAX - sizeof(EFI_SIGNATURE_LIST)) / sig_size)
 		return EFI_INVALID_PARAMETER;
 
-	needed = sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_GUID) + data_len;
+	needed = sizeof(EFI_SIGNATURE_LIST) + data_len;
 	if (!out || *outlen < needed) {
 		*outlen = needed;
 		return EFI_BUFFER_TOO_SMALL;
@@ -35,27 +41,70 @@ fill_esl(const uint8_t *data, const size_t data_len,
 
 	sl->SignatureHeaderSize = 0;
 	sl->SignatureType = *type;
-	sl->SignatureSize = sizeof(EFI_GUID) + data_len;
+	sl->SignatureSize = sig_size;
 	sl->SignatureListSize = needed;
 
 	sd = (EFI_SIGNATURE_DATA *)(out + sizeof(EFI_SIGNATURE_LIST));
-	if (owner)
-		sd->SignatureOwner = *owner;
-
-	CopyMem(sd->SignatureData, data, data_len);
+	CopyMem(sd, first_sig, data_len);
 
 	return EFI_SUCCESS;
 }
 
 EFI_STATUS
-variable_create_esl(const uint8_t *data, const size_t data_len,
-		    const EFI_GUID *type, const EFI_GUID *owner,
+fill_esl_with_one_signature(const uint8_t *data, const uint32_t data_len,
+			    const EFI_GUID *type, const EFI_GUID *owner,
+			    uint8_t *out, size_t *outlen)
+{
+	EFI_STATUS efi_status;
+	EFI_SIGNATURE_DATA *sd = NULL;
+	UINT32 sig_size = sizeof(EFI_SIGNATURE_DATA) - 1 + data_len;
+
+	if (data_len > UINT32_MAX - sizeof(EFI_SIGNATURE_DATA) + 1)
+		return EFI_INVALID_PARAMETER;
+
+	if (out) {
+		sd = AllocateZeroPool(sig_size);
+		if (owner)
+			CopyMem(sd, owner, sizeof(EFI_GUID));
+		CopyMem(sd->SignatureData, data, data_len);
+	}
+
+	efi_status = fill_esl(sd, 1, type, sig_size, out, outlen);
+
+	if (out)
+		FreePool(sd);
+	return efi_status;
+}
+
+EFI_STATUS
+variable_create_esl(const EFI_SIGNATURE_DATA *first_sig, const size_t howmany,
+		    const EFI_GUID *type, const UINT32 sig_size,
 		    uint8_t **out, size_t *outlen)
 {
 	EFI_STATUS efi_status;
 
 	*outlen = 0;
-	efi_status = fill_esl(data, data_len, type, owner, NULL, outlen);
+	efi_status = fill_esl(first_sig, howmany, type, sig_size, NULL, outlen);
+	if (efi_status != EFI_BUFFER_TOO_SMALL)
+		return efi_status;
+
+	*out = AllocateZeroPool(*outlen);
+	if (!*out)
+		return EFI_OUT_OF_RESOURCES;
+
+	return fill_esl(first_sig, howmany, type, sig_size, *out, outlen);
+}
+
+EFI_STATUS
+variable_create_esl_with_one_signature(const uint8_t* data, const size_t data_len,
+				       const EFI_GUID *type, const EFI_GUID *owner,
+				       uint8_t **out, size_t *outlen)
+{
+	EFI_STATUS efi_status;
+
+	*outlen = 0;
+	efi_status = fill_esl_with_one_signature(data, data_len, type, owner,
+						 NULL, outlen);
 	if (efi_status != EFI_BUFFER_TOO_SMALL)
 		return efi_status;
 
@@ -63,7 +112,8 @@ variable_create_esl(const uint8_t *data, const size_t data_len,
 	if (!*out)
 		return EFI_OUT_OF_RESOURCES;
 
-	return fill_esl(data, data_len, type, owner, *out, outlen);
+	return fill_esl_with_one_signature(data, data_len, type, owner, *out,
+					   outlen);
 }
 
 EFI_STATUS
@@ -153,8 +203,9 @@ SetSecureVariable(const CHAR16 * const var, UINT8 *Data, UINTN len,
 
 	if (createtimebased) {
 		size_t ds;
-		efi_status = variable_create_esl(Data, len, &X509_GUID, NULL,
-						 (uint8_t **)&Cert, &ds);
+		efi_status = variable_create_esl_with_one_signature(
+			Data, len, &X509_GUID, NULL,
+			(uint8_t **)&Cert, &ds);
 		if (EFI_ERROR(efi_status)) {
 			console_print(L"Failed to create %s certificate %d\n",
 				      var, efi_status);
diff --git a/mok.c b/mok.c
index e3c3d9ee..3d2b398c 100644
--- a/mok.c
+++ b/mok.c
@@ -303,8 +303,8 @@ mirror_one_esl(CHAR16 *name, EFI_GUID *guid, UINT32 attrs,
 	       UINTN *newsz, SIZE_T maxsz)
 {
 	EFI_STATUS efi_status;
-	SIZE_T howmany, varsz = 0, esdsz;
-	UINT8 *var, *data;
+	SIZE_T howmany, varsz = 0;
+	UINT8 *var;
 
 	howmany = MIN((maxsz - sizeof(*esl)) / esl->SignatureSize,
 		      (esl->SignatureListSize - sizeof(*esl)) / esl->SignatureSize);
@@ -316,8 +316,6 @@ mirror_one_esl(CHAR16 *name, EFI_GUID *guid, UINT32 attrs,
 	 * We always assume esl->SignatureHeaderSize is 0 (and so far,
 	 * that's true as per UEFI 2.8)
 	 */
-	esdsz = howmany * esl->SignatureSize;
-	data = (UINT8 *)esd;
 	dprint(L"Trying to add %lx signatures to \"%s\" of size %lx\n",
 	       howmany, name, esl->SignatureSize);
 
@@ -327,10 +325,9 @@ mirror_one_esl(CHAR16 *name, EFI_GUID *guid, UINT32 attrs,
 	 *
 	 * Compensate here.
 	 */
-	efi_status = variable_create_esl(data + sizeof(EFI_GUID),
-					 esdsz - sizeof(EFI_GUID),
+	efi_status = variable_create_esl(esd, howmany,
 					 &esl->SignatureType,
-					 &esd->SignatureOwner,
+					 esl->SignatureSize,
 					 &var, &varsz);
 	if (EFI_ERROR(efi_status) || !var || !varsz) {
 		LogError(L"Couldn't allocate %lu bytes for mok variable \"%s\": %r\n",
@@ -349,7 +346,7 @@ mirror_one_esl(CHAR16 *name, EFI_GUID *guid, UINT32 attrs,
 		return efi_status;
 	}
 
-	*newsz = esdsz;
+	*newsz = howmany * esl->SignatureSize;
 
 	return efi_status;
 }
@@ -507,7 +504,7 @@ mirror_mok_db(CHAR16 *name, CHAR8 *name8, EFI_GUID *guid, UINT32 attrs,
 		UINT8 *var;
 		UINTN varsz;
 
-		efi_status = variable_create_esl(
+		efi_status = variable_create_esl_with_one_signature(
 				null_sha256, sizeof(null_sha256),
 				&EFI_CERT_SHA256_GUID, &SHIM_LOCK_GUID,
 				&var, &varsz);
@@ -592,10 +589,12 @@ mirror_one_mok_variable(struct mok_state_variable *v,
 			       FullDataSize, FullData);
 			break;
 		case VENDOR_ADDEND_X509:
-			efi_status = fill_esl(*v->addend, *v->addend_size,
-					      &EFI_CERT_TYPE_X509_GUID,
-					      &SHIM_LOCK_GUID,
-					      NULL, &addend_esl_sz);
+			efi_status = fill_esl_with_one_signature(*v->addend,
+								 *v->addend_size,
+								 &EFI_CERT_TYPE_X509_GUID,
+								 &SHIM_LOCK_GUID,
+								 NULL,
+								 &addend_esl_sz);
 			if (efi_status != EFI_BUFFER_TOO_SMALL) {
 				perror(L"Could not add built-in cert to %s: %r\n",
 				       v->name, efi_status);
@@ -616,11 +615,11 @@ mirror_one_mok_variable(struct mok_state_variable *v,
 		 * then the build cert if it's there
 		 */
 		if (should_mirror_build_cert(v)) {
-			efi_status = fill_esl(*v->build_cert,
-					      *v->build_cert_size,
-					      &EFI_CERT_TYPE_X509_GUID,
-					      &SHIM_LOCK_GUID,
-					      NULL, &build_cert_esl_sz);
+			efi_status = fill_esl_with_one_signature(*v->build_cert,
+								 *v->build_cert_size,
+								 &EFI_CERT_TYPE_X509_GUID,
+								 &SHIM_LOCK_GUID,
+								 NULL, &build_cert_esl_sz);
 			if (efi_status != EFI_BUFFER_TOO_SMALL) {
 				perror(L"Could not add built-in cert to %s: %r\n",
 				       v->name, efi_status);
@@ -703,10 +702,11 @@ mirror_one_mok_variable(struct mok_state_variable *v,
 			       FullDataSize, FullData, p, p-(uintptr_t)FullData);
 			break;
 		case VENDOR_ADDEND_X509:
-			efi_status = fill_esl(*v->addend, *v->addend_size,
-					      &EFI_CERT_TYPE_X509_GUID,
-					      &SHIM_LOCK_GUID,
-					      p, &addend_esl_sz);
+			efi_status = fill_esl_with_one_signature(*v->addend,
+								 *v->addend_size,
+								 &EFI_CERT_TYPE_X509_GUID,
+								 &SHIM_LOCK_GUID,
+								 p, &addend_esl_sz);
 			if (EFI_ERROR(efi_status)) {
 				perror(L"Could not add built-in cert to %s: %r\n",
 				       v->name, efi_status);
@@ -729,11 +729,11 @@ mirror_one_mok_variable(struct mok_state_variable *v,
 		dprint(L"FullDataSize:%lu FullData:0x%llx p:0x%llx pos:%lld\n",
 		       FullDataSize, FullData, p, p-(uintptr_t)FullData);
 		if (should_mirror_build_cert(v)) {
-			efi_status = fill_esl(*v->build_cert,
-					      *v->build_cert_size,
-					      &EFI_CERT_TYPE_X509_GUID,
-					      &SHIM_LOCK_GUID,
-					      p, &build_cert_esl_sz);
+			efi_status = fill_esl_with_one_signature(*v->build_cert,
+								 *v->build_cert_size,
+								 &EFI_CERT_TYPE_X509_GUID,
+								 &SHIM_LOCK_GUID,
+								 p, &build_cert_esl_sz);
 			if (EFI_ERROR(efi_status)) {
 				perror(L"Could not add built-in cert to %s: %r\n",
 				       v->name, efi_status);
@@ -765,7 +765,7 @@ mirror_one_mok_variable(struct mok_state_variable *v,
 	 * need a dummy entry
 	 */
 	if ((v->flags & MOK_MIRROR_KEYDB) && FullDataSize == 0) {
-		efi_status = variable_create_esl(
+		efi_status = variable_create_esl_with_one_signature(
 				null_sha256, sizeof(null_sha256),
 				&EFI_CERT_SHA256_GUID, &SHIM_LOCK_GUID,
 				&FullData, &FullDataSize);
-- 
cgit v1.2.3


From f9294c2fa9feaf5353c0b7a4a7ce102a820c1a3f Mon Sep 17 00:00:00 2001
From: Chris Coulson <chris.coulson@canonical.com>
Date: Fri, 19 Mar 2021 16:50:05 +0000
Subject: Fix boot failures due to variable size constraints

There are multiple issues in the MOK variable mirroring code due
to volatile variable size constraints, which all result in boot
failures:

- If a signature is encountered which doesn't fit in to a single
variable, the code enters an infinite loop because the cursor
isn't advanced in mirror_mok_db() after the call to
mirror_one_esl().

- If an ESL is encountered which doesn't fit in to a single
variable, it looks like the intention is for the ESL to be split
across multiple variables. However, mirror_one_esl() will write
the maximum variable size on each call, regardless of how much
data is remaining for the current ESL. If the size of a ESL isn't
a multiple of the maximum variable size, the final call to
mirror_one_esl() will append data from the start of the next
ESL and the cursor in mirror_mok_db() will be advanced to an
arbitrary location in the next ESL. This either results in garbage
being mirrored (if you're lucky), or in my case - another infinite
loop as it appears to encounter a signature that doesn't fit in to
a single variable.

- If no signatures can be mirrored when mirror_mok_db() is called
with only_first=TRUE, it tries to create a variable with a single
SHA256 signature in it. But mirror_mok_db() returns an error
(EFI_INVALID_PARAMETER) regardless of whether this succeeds.
---
 lib/variables.c |  2 +-
 mok.c           | 60 +++++++++++++++++++++++++++++----------------------------
 2 files changed, 32 insertions(+), 30 deletions(-)

(limited to 'lib/variables.c')

diff --git a/lib/variables.c b/lib/variables.c
index 53a5d14a..f606e248 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -22,7 +22,7 @@ fill_esl(const EFI_SIGNATURE_DATA *first_sig, const size_t howmany,
 	size_t needed = 0;
 	size_t data_len = howmany * sig_size;
 
-	dprint(L"fill_esl: data=%p, data_len=%lu", first_sig, data_len);
+	dprint(L"fill_esl: first_sig=0x%llx, data_len=%lu\n", first_sig, data_len);
 
 	if ((out && !first_sig) || !howmany || !type || !sig_size || !outlen)
 		return EFI_INVALID_PARAMETER;
diff --git a/mok.c b/mok.c
index 345c322c..5ad9072b 100644
--- a/mok.c
+++ b/mok.c
@@ -300,18 +300,12 @@ get_max_var_sz(UINT32 attrs, SIZE_T *max_var_szp)
 static EFI_STATUS
 mirror_one_esl(CHAR16 *name, EFI_GUID *guid, UINT32 attrs,
 	       EFI_SIGNATURE_LIST *esl, EFI_SIGNATURE_DATA *esd,
-	       UINTN *newsz, SIZE_T maxsz)
+	       SIZE_T howmany)
 {
 	EFI_STATUS efi_status;
-	SIZE_T howmany, varsz = 0;
+	SIZE_T varsz = 0;
 	UINT8 *var;
 
-	howmany = MIN((maxsz - sizeof(*esl)) / esl->SignatureSize,
-		      (esl->SignatureListSize - sizeof(*esl)) / esl->SignatureSize);
-	if (howmany < 1) {
-		return EFI_BUFFER_TOO_SMALL;
-	}
-
 	/*
 	 * We always assume esl->SignatureHeaderSize is 0 (and so far,
 	 * that's true as per UEFI 2.8)
@@ -346,8 +340,6 @@ mirror_one_esl(CHAR16 *name, EFI_GUID *guid, UINT32 attrs,
 		return efi_status;
 	}
 
-	*newsz = howmany * esl->SignatureSize;
-
 	return efi_status;
 }
 
@@ -459,12 +451,25 @@ mirror_mok_db(CHAR16 *name, CHAR8 *name8, EFI_GUID *guid, UINT32 attrs,
 			return efi_status;
 		}
 
+		/* The name counts towards the size of the variable */
+		max_var_sz -= (StrLen(namen) + 1) * 2;
+		dprint(L"max_var_sz - name: %lx\n", max_var_sz);
+
 		SIZE_T howmany;
-		UINTN adj = 0;
 		howmany = MIN((max_var_sz - sizeof(*esl)) / esl->SignatureSize,
-			      (esl->SignatureListSize - sizeof(*esl)) / esl->SignatureSize);
-		if (!only_first && i == 0 && howmany >= 1) {
-			adj = howmany * esl->SignatureSize;
+			      (esl_end_pos - pos) / esl->SignatureSize);
+		if (howmany == 0) {
+			/* No signatures from this ESL can be mirrored in to a
+			 * single variable, so skip it.
+			 */
+			dprint(L"skipping esl, pos:0x%llx->0x%llx\n", pos, esl_end_pos);
+			pos = esl_end_pos;
+			continue;
+		}
+
+		UINTN adj = howmany * esl->SignatureSize;
+
+		if (!only_first && i == 0) {
 			dprint(L"pos:0x%llx->0x%llx\n", pos, pos + adj);
 			pos += adj;
 			i++;
@@ -473,25 +478,25 @@ mirror_mok_db(CHAR16 *name, CHAR8 *name8, EFI_GUID *guid, UINT32 attrs,
 		}
 
 		efi_status = mirror_one_esl(namen, guid, attrs,
-					    esl, esd, &adj, max_var_sz);
+					    esl, esd, howmany);
 		dprint(L"esd:0x%llx adj:0x%llx\n", esd, adj);
-		if (EFI_ERROR(efi_status) && efi_status != EFI_BUFFER_TOO_SMALL) {
+		if (EFI_ERROR(efi_status)) {
 			LogError(L"Could not mirror mok variable \"%s\": %r\n",
 				 namen, efi_status);
 			break;
 		}
 
-		if (!EFI_ERROR(efi_status)) {
-			did_one = TRUE;
-			if (only_first)
-				break;
-			dprint(L"pos:0x%llx->0x%llx\n", pos, pos + adj);
-			pos += adj;
-			i++;
-		}
+		dprint(L"pos:0x%llx->0x%llx\n", pos, pos + adj);
+		pos += adj;
+		did_one = TRUE;
+		if (only_first)
+			break;
+		i++;
 	}
 
-	if (only_first && !did_one) {
+	if (EFI_ERROR(efi_status)) {
+		perror(L"Failed to set %s: %r\n", name, efi_status);
+	} else if (only_first && !did_one) {
 		/*
 		 * In this case we're going to try to create a
 		 * dummy variable so that there's one there.  It
@@ -513,15 +518,12 @@ mirror_mok_db(CHAR16 *name, CHAR8 *name8, EFI_GUID *guid, UINT32 attrs,
 		 * doesn't.
 		 */
 		if (!EFI_ERROR(efi_status) && var && varsz) {
-			SetVariable(name, guid,
+			efi_status = SetVariable(name, guid,
 				    EFI_VARIABLE_BOOTSERVICE_ACCESS
 				    | EFI_VARIABLE_RUNTIME_ACCESS,
 				    varsz, var);
 			FreePool(var);
 		}
-		efi_status = EFI_INVALID_PARAMETER;
-	} else if (EFI_ERROR(efi_status)) {
-		perror(L"Failed to set %s: %r\n", name, efi_status);
 	}
 	return efi_status;
 }
-- 
cgit v1.2.3


From f1ef8dffd374048fbf8dd584923c42e5a784bbf2 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Thu, 15 Jul 2021 10:07:14 -0400
Subject: Make test cases link against libefi.a

This allows us to use library functions from libefi.a in our test
programs.

Signed-off-by: Peter Jones <pjones@redhat.com>
---
 include/test.mk | 20 +++++++++++++++++---
 lib/variables.c | 48 ++++++++++++++++++++++++++----------------------
 test.c          | 37 ++++++-------------------------------
 3 files changed, 49 insertions(+), 56 deletions(-)

(limited to 'lib/variables.c')

diff --git a/include/test.mk b/include/test.mk
index 62cf983a..c66b46de 100644
--- a/include/test.mk
+++ b/include/test.mk
@@ -5,6 +5,8 @@
 
 .SUFFIXES:
 
+include Make.defaults
+
 CC = gcc
 VALGRIND ?=
 DEBUG_PRINTS ?= 0
@@ -28,6 +30,15 @@ CFLAGS = -O2 -ggdb -std=gnu11 \
 	 -DSHIM_UNIT_TEST \
 	 "-DDEFAULT_DEBUG_PRINT_STATE=$(DEBUG_PRINTS)"
 
+libefi-test.a :
+	$(MAKE) -C gnu-efi ARCH=$(ARCH_GNUEFI) TOPDIR=$(TOPDIR)/gnu-efi \
+		-f $(TOPDIR)/gnu-efi/Makefile \
+		clean lib
+	mv gnu-efi/$(ARCH)/lib/libefi.a $@
+	$(MAKE) -C gnu-efi ARCH=$(ARCH_GNUEFI) TOPDIR=$(TOPDIR)/gnu-efi \
+		-f $(TOPDIR)/gnu-efi/Makefile \
+		clean
+
 $(wildcard test-*.c) :: %.c : test-random.h
 $(patsubst %.c,%,$(wildcard test-*.c)) :: | test-random.h
 $(patsubst %.c,%.o,$(wildcard test-*.c)) : | test-random.h
@@ -36,19 +47,22 @@ test-random.h:
 	dd if=/dev/urandom bs=512 count=17 of=random.bin
 	xxd -i random.bin test-random.h
 
-test-sbat_FILES = csv.c
+test-sbat_FILES = csv.c lib/variables.c lib/guid.c
+test-sbat :: CFLAGS+=-DHAVE_GET_VARIABLE -DHAVE_GET_VARIABLE_ATTR -DHAVE_SHIM_LOCK_GUID
+
 test-str_FILES = lib/string.c
 
 tests := $(patsubst %.c,%,$(wildcard test-*.c))
 
+$(tests) :: test-% : | libefi-test.a
 $(tests) :: test-% : test.c test-%.c $(test-%_FILES)
-	$(CC) $(CFLAGS) -o $@ $^ $(wildcard $*.c) $(test-$*_FILES)
+	$(CC) $(CFLAGS) -o $@ $^ $(wildcard $*.c) $(test-$*_FILES) libefi-test.a
 	$(VALGRIND) ./$@
 
 test : $(tests)
 
 clean :
-	@rm -vf test-random.h random.bin
+	@rm -vf test-random.h random.bin libefi-test.a
 
 all : clean test
 
diff --git a/lib/variables.c b/lib/variables.c
index f606e248..ff61d0e2 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -12,6 +12,10 @@
  */
 #include "shim.h"
 
+extern EFI_SYSTEM_TABLE *ST;
+extern EFI_BOOT_SERVICES *BS;
+extern EFI_RUNTIME_SERVICES *RT;
+
 EFI_STATUS
 fill_esl(const EFI_SIGNATURE_DATA *first_sig, const size_t howmany,
 	 const EFI_GUID *type, const UINT32 sig_size,
@@ -154,7 +158,7 @@ CreateTimeBasedPayload(IN OUT UINTN * DataSize, IN OUT UINT8 ** Data)
 	DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
 
 	ZeroMem(&Time, sizeof(EFI_TIME));
-	efi_status = gRT->GetTime(&Time, NULL);
+	efi_status = RT->GetTime(&Time, NULL);
 	if (EFI_ERROR(efi_status)) {
 		FreePool(NewData);
 		return efi_status;
@@ -225,7 +229,7 @@ SetSecureVariable(const CHAR16 * const var, UINT8 *Data, UINTN len,
 		return efi_status;
 	}
 
-	efi_status = gRT->SetVariable((CHAR16 *)var, &owner,
+	efi_status = RT->SetVariable((CHAR16 *)var, &owner,
 			EFI_VARIABLE_NON_VOLATILE |
 			EFI_VARIABLE_RUNTIME_ACCESS |
 			EFI_VARIABLE_BOOTSERVICE_ACCESS |
@@ -241,8 +245,8 @@ GetOSIndications(void)
 	UINTN DataSize = sizeof(indications);
 	EFI_STATUS efi_status;
 
-	efi_status = gRT->GetVariable(L"OsIndicationsSupported", &GV_GUID,
-				      NULL, &DataSize, &indications);
+	efi_status = RT->GetVariable(L"OsIndicationsSupported", &GV_GUID,
+				     NULL, &DataSize, &indications);
 	if (EFI_ERROR(efi_status))
 		return 0;
 
@@ -255,15 +259,15 @@ SETOSIndicationsAndReboot(UINT64 indications)
 	UINTN DataSize = sizeof(indications);
 	EFI_STATUS efi_status;
 
-	efi_status = gRT->SetVariable(L"OsIndications", &GV_GUID,
-				      EFI_VARIABLE_NON_VOLATILE |
-				      EFI_VARIABLE_RUNTIME_ACCESS |
-				      EFI_VARIABLE_BOOTSERVICE_ACCESS,
-				      DataSize, &indications);
+	efi_status = RT->SetVariable(L"OsIndications", &GV_GUID,
+				     EFI_VARIABLE_NON_VOLATILE |
+				     EFI_VARIABLE_RUNTIME_ACCESS |
+				     EFI_VARIABLE_BOOTSERVICE_ACCESS,
+				     DataSize, &indications);
 	if (EFI_ERROR(efi_status))
 		return efi_status;
 
-	gRT->ResetSystem(EfiResetWarm, EFI_SUCCESS, 0, NULL);
+	RT->ResetSystem(EfiResetWarm, EFI_SUCCESS, 0, NULL);
 	/* does not return */
 
 	return EFI_SUCCESS;
@@ -280,7 +284,7 @@ get_variable_attr(const CHAR16 * const var, UINT8 **data, UINTN *len,
 
 	*len = 0;
 
-	efi_status = gRT->GetVariable((CHAR16 *)var, &owner, NULL, len, NULL);
+	efi_status = RT->GetVariable((CHAR16 *)var, &owner, NULL, len, NULL);
 	if (efi_status != EFI_BUFFER_TOO_SMALL) {
 		if (!EFI_ERROR(efi_status)) /* this should never happen */
 			return EFI_PROTOCOL_ERROR;
@@ -298,7 +302,7 @@ get_variable_attr(const CHAR16 * const var, UINT8 **data, UINTN *len,
 	if (!*data)
 		return EFI_OUT_OF_RESOURCES;
 
-	efi_status = gRT->GetVariable((CHAR16 *)var, &owner, attributes, len, *data);
+	efi_status = RT->GetVariable((CHAR16 *)var, &owner, attributes, len, *data);
 	if (EFI_ERROR(efi_status)) {
 		FreePool(*data);
 		*data = NULL;
@@ -341,7 +345,7 @@ EFI_STATUS
 set_variable(CHAR16 *var, EFI_GUID owner, UINT32 attributes,
 	     UINTN datasize, void *data)
 {
-	return gRT->SetVariable(var, &owner, attributes, datasize, data);
+	return RT->SetVariable(var, &owner, attributes, datasize, data);
 }
 
 EFI_STATUS
@@ -394,8 +398,8 @@ variable_is_setupmode(int default_return)
 	UINTN DataSize = sizeof(SetupMode);
 	EFI_STATUS efi_status;
 
-	efi_status = gRT->GetVariable(L"SetupMode", &GV_GUID, NULL,
-				      &DataSize, &SetupMode);
+	efi_status = RT->GetVariable(L"SetupMode", &GV_GUID, NULL,
+				     &DataSize, &SetupMode);
 	if (EFI_ERROR(efi_status))
 		return default_return;
 
@@ -411,8 +415,8 @@ variable_is_secureboot(void)
 	EFI_STATUS efi_status;
 
 	DataSize = sizeof(SecureBoot);
-	efi_status = gRT->GetVariable(L"SecureBoot", &GV_GUID, NULL,
-				      &DataSize, &SecureBoot);
+	efi_status = RT->GetVariable(L"SecureBoot", &GV_GUID, NULL,
+				     &DataSize, &SecureBoot);
 	if (EFI_ERROR(efi_status))
 		return 0;
 
@@ -445,10 +449,10 @@ variable_enroll_hash(const CHAR16 * const var, EFI_GUID owner,
 		efi_status = SetSecureVariable(var, sig, sizeof(sig), owner,
 					       EFI_VARIABLE_APPEND_WRITE, 0);
 	else
-		efi_status = gRT->SetVariable((CHAR16 *)var, &owner,
-					      EFI_VARIABLE_NON_VOLATILE |
-					      EFI_VARIABLE_BOOTSERVICE_ACCESS |
-					      EFI_VARIABLE_APPEND_WRITE,
-					      sizeof(sig), sig);
+		efi_status = RT->SetVariable((CHAR16 *)var, &owner,
+					     EFI_VARIABLE_NON_VOLATILE |
+					     EFI_VARIABLE_BOOTSERVICE_ACCESS |
+					     EFI_VARIABLE_APPEND_WRITE,
+					     sizeof(sig), sig);
 	return efi_status;
 }
diff --git a/test.c b/test.c
index 9da5cf5b..11e0c642 100644
--- a/test.c
+++ b/test.c
@@ -22,37 +22,6 @@ LogError_(const char *file, int line, const char *func, const CHAR16 *fmt, ...)
 	return EFI_SUCCESS;
 }
 
-#ifndef HAVE_STRCMP
-INTN
-StrCmp(CONST CHAR16 *s1, CONST CHAR16 *s2) {
-	assert(s1 != NULL);
-	assert(s2 != NULL);
-
-	int i;
-	for (i = 0; s1[i] && s2[i]; i++) {
-		if (s1[i] != s2[i])
-			return s2[i] - s1[i];
-	}
-	return 0;
-}
-#endif
-
-#ifndef HAVE_STRNCMP
-INTN
-StrnCmp(CONST CHAR16 *s1, CONST CHAR16 *s2, UINTN len) {
-	assert(s1 != NULL);
-	assert(s2 != NULL);
-
-	UINTN i;
-	for (i = 0; i < len && s1[i] && s2[i]; i++) {
-		if (s1[i] != s2[i])
-			return s2[i] - s1[i];
-
-	}
-	return 0;
-}
-#endif
-
 #ifndef HAVE_GET_VARIABLE_ATTR
 EFI_STATUS
 get_variable_attr(const CHAR16 * const var, UINT8 **data, UINTN *len,
@@ -74,4 +43,10 @@ get_variable(const CHAR16 * const var, UINT8 **data, UINTN *len, EFI_GUID owner)
 EFI_GUID SHIM_LOCK_GUID = {0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 } };
 #endif
 
+UINTN EFIAPI
+console_print(const CHAR16 *fmt, ...)
+{
+	return 0;
+}
+
 // vim:fenc=utf-8:tw=75:noet
-- 
cgit v1.2.3


From e13ac7386ea425c9222e05a2f9879d5af5cb91f6 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Wed, 4 Aug 2021 13:24:11 -0400
Subject: Make CopyMem() work with EFI's declaration

EFI_BOOT_SERVICES includes CopyMem() and SetMem() functions which are
marked EFIAPI, and in the case of CopyMem() does not mark the source
argument as CONST.

This patch makes all our invocations work with that, so (once gnu-efi's
implementation is fixed to match) we can use the existing implementation
as the implementation in a mock EFI_BOOT_SERVICES.

Signed-off-by: Peter Jones <pjones@redhat.com>
---
 Cryptlib/Hash/CryptMd5.c          | 2 +-
 Cryptlib/Hash/CryptSha1.c         | 2 +-
 Cryptlib/Hash/CryptSha256.c       | 2 +-
 Cryptlib/Hash/CryptSha512.c       | 4 ++--
 Cryptlib/Include/OpenSslSupport.h | 4 ++--
 Cryptlib/Pk/CryptPkcs7Verify.c    | 2 +-
 httpboot.c                        | 6 +++---
 lib/variables.c                   | 6 +++---
 8 files changed, 14 insertions(+), 14 deletions(-)

(limited to 'lib/variables.c')

diff --git a/Cryptlib/Hash/CryptMd5.c b/Cryptlib/Hash/CryptMd5.c
index ccf6ad00..b389f0e1 100644
--- a/Cryptlib/Hash/CryptMd5.c
+++ b/Cryptlib/Hash/CryptMd5.c
@@ -93,7 +93,7 @@ Md5Duplicate (
     return FALSE;
   }
 
-  CopyMem (NewMd5Context, Md5Context, sizeof (MD5_CTX));
+  CopyMem (NewMd5Context, (void *)Md5Context, sizeof (MD5_CTX));
 
   return TRUE;
 }
diff --git a/Cryptlib/Hash/CryptSha1.c b/Cryptlib/Hash/CryptSha1.c
index 42cfd08a..3e67a805 100644
--- a/Cryptlib/Hash/CryptSha1.c
+++ b/Cryptlib/Hash/CryptSha1.c
@@ -92,7 +92,7 @@ Sha1Duplicate (
     return FALSE;
   }
 
-  CopyMem (NewSha1Context, Sha1Context, sizeof (SHA_CTX));
+  CopyMem (NewSha1Context, (void *)Sha1Context, sizeof (SHA_CTX));
 
   return TRUE;
 }
diff --git a/Cryptlib/Hash/CryptSha256.c b/Cryptlib/Hash/CryptSha256.c
index 06ecb2e9..05bc6b0a 100644
--- a/Cryptlib/Hash/CryptSha256.c
+++ b/Cryptlib/Hash/CryptSha256.c
@@ -91,7 +91,7 @@ Sha256Duplicate (
     return FALSE;
   }
 
-  CopyMem (NewSha256Context, Sha256Context, sizeof (SHA256_CTX));
+  CopyMem (NewSha256Context, (void *)Sha256Context, sizeof (SHA256_CTX));
 
   return TRUE;
 }
diff --git a/Cryptlib/Hash/CryptSha512.c b/Cryptlib/Hash/CryptSha512.c
index 3ce372a0..16063b23 100644
--- a/Cryptlib/Hash/CryptSha512.c
+++ b/Cryptlib/Hash/CryptSha512.c
@@ -93,7 +93,7 @@ Sha384Duplicate (
     return FALSE;
   }
 
-  CopyMem (NewSha384Context, Sha384Context, sizeof (SHA512_CTX));
+  CopyMem (NewSha384Context, (void *)Sha384Context, sizeof (SHA512_CTX));
 
   return TRUE;
 }
@@ -308,7 +308,7 @@ Sha512Duplicate (
     return FALSE;
   }
 
-  CopyMem (NewSha512Context, Sha512Context, sizeof (SHA512_CTX));
+  CopyMem (NewSha512Context, (void *)Sha512Context, sizeof (SHA512_CTX));
 
   return TRUE;
 }
diff --git a/Cryptlib/Include/OpenSslSupport.h b/Cryptlib/Include/OpenSslSupport.h
index b97149e2..0c2fb8b0 100644
--- a/Cryptlib/Include/OpenSslSupport.h
+++ b/Cryptlib/Include/OpenSslSupport.h
@@ -262,11 +262,11 @@ extern FILE  *stdout;
 //
 // Macros that directly map functions to BaseLib, BaseMemoryLib, and DebugLib functions
 //
-#define memcpy(dest,source,count)         ( {CopyMem(dest,source,(UINTN)(count)); dest; })
+#define memcpy(dest,source,count)         ( {CopyMem(dest,(void *)source,(UINTN)(count)); dest; })
 #define memset(dest,ch,count)             SetMem(dest,(UINTN)(count),(UINT8)(ch))
 #define memchr(buf,ch,count)              ScanMem8((CHAR8 *)buf,(UINTN)(count),ch)
 #define memcmp(buf1,buf2,count)           (int)(CompareMem(buf1,buf2,(UINTN)(count)))
-#define memmove(dest,source,count)        CopyMem(dest,source,(UINTN)(count))
+#define memmove(dest,source,count)        CopyMem(dest,(void *)source,(UINTN)(count))
 #define localtime(timer)                  NULL
 #define assert(expression)
 #define atoi(nptr)                        AsciiStrDecimalToUintn((const CHAR8 *)nptr)
diff --git a/Cryptlib/Pk/CryptPkcs7Verify.c b/Cryptlib/Pk/CryptPkcs7Verify.c
index 09895d8c..c1893848 100644
--- a/Cryptlib/Pk/CryptPkcs7Verify.c
+++ b/Cryptlib/Pk/CryptPkcs7Verify.c
@@ -216,7 +216,7 @@ WrapPkcs7Data (
     //
     // Part7: P7Data.
     //
-    CopyMem (SignedData + 19, P7Data, P7Length);
+    CopyMem (SignedData + 19, (void *)P7Data, P7Length);
   }
 
   *WrapFlag = Wrapped;
diff --git a/httpboot.c b/httpboot.c
index 5d16bc1e..3340a7f9 100644
--- a/httpboot.c
+++ b/httpboot.c
@@ -179,8 +179,8 @@ generate_next_uri (CONST CHAR8 *current_uri, CONST CHAR8 *next_loader,
 	if (!*uri)
 		return EFI_OUT_OF_RESOURCES;
 
-	CopyMem(*uri, current_uri, path_len);
-	CopyMem(*uri + path_len, next_loader, next_len);
+	CopyMem(*uri, (void *)current_uri, path_len);
+	CopyMem(*uri + path_len, (void *)next_loader, next_len);
 	(*uri)[path_len + next_len] = '\0';
 
 	return EFI_SUCCESS;
@@ -209,7 +209,7 @@ extract_hostname (CONST CHAR8 *url, CHAR8 **hostname)
 	if (!*hostname)
 		return EFI_OUT_OF_RESOURCES;
 
-	CopyMem(*hostname, start, host_len);
+	CopyMem(*hostname, (void *)start, host_len);
 	(*hostname)[host_len] = '\0';
 
 	return EFI_SUCCESS;
diff --git a/lib/variables.c b/lib/variables.c
index ff61d0e2..3ec05478 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -49,7 +49,7 @@ fill_esl(const EFI_SIGNATURE_DATA *first_sig, const size_t howmany,
 	sl->SignatureListSize = needed;
 
 	sd = (EFI_SIGNATURE_DATA *)(out + sizeof(EFI_SIGNATURE_LIST));
-	CopyMem(sd, first_sig, data_len);
+	CopyMem(sd, (void *)first_sig, data_len);
 
 	return EFI_SUCCESS;
 }
@@ -69,8 +69,8 @@ fill_esl_with_one_signature(const uint8_t *data, const uint32_t data_len,
 	if (out) {
 		sd = AllocateZeroPool(sig_size);
 		if (owner)
-			CopyMem(sd, owner, sizeof(EFI_GUID));
-		CopyMem(sd->SignatureData, data, data_len);
+			CopyMem(sd, (void *)owner, sizeof(EFI_GUID));
+		CopyMem(sd->SignatureData, (void *)data, data_len);
 	}
 
 	efi_status = fill_esl(sd, 1, type, sig_size, out, outlen);
-- 
cgit v1.2.3


From d0df9304c7a777557e1925dc9f75406ec00e6179 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Thu, 9 Dec 2021 17:21:45 -0500
Subject: Minor coverity fixes

- one missing free
- one minor deadcode issue
- two unchecked allocations
- one debug hexdump of a variable we just freed

Signed-off-by: Peter Jones <pjones@redhat.com>
---
 MokManager.c      | 1 +
 fallback.c        | 7 +++++--
 include/hexdump.h | 7 ++++++-
 lib/variables.c   | 2 ++
 mok.c             | 4 +++-
 5 files changed, 17 insertions(+), 4 deletions(-)

(limited to 'lib/variables.c')

diff --git a/MokManager.c b/MokManager.c
index c195cadc..1359af83 100644
--- a/MokManager.c
+++ b/MokManager.c
@@ -339,6 +339,7 @@ static void show_x509_info(X509 * X509Cert, UINT8 * hash)
 		for (i = 0; i < n; i++) {
 			CatPrint(&serial_string, L"%02x:", hexbuf[i]);
 		}
+		BN_free(bnser);
 	}
 
 	if (serial_string.str)
diff --git a/fallback.c b/fallback.c
index 5da867dd..8e6327be 100644
--- a/fallback.c
+++ b/fallback.c
@@ -230,8 +230,11 @@ add_boot_option(EFI_DEVICE_PATH *hddp, EFI_DEVICE_PATH *fulldp,
 				StrLen(label)*2 + 2 + DevicePathSize(hddp) +
 				StrLen(arguments) * 2;
 
-			CHAR8 *data = AllocateZeroPool(size + 2);
-			CHAR8 *cursor = data;
+			CHAR8 *data, *cursor;
+			cursor = data = AllocateZeroPool(size + 2);
+			if (!data)
+				return EFI_OUT_OF_RESOURCES;
+
 			*(UINT32 *)cursor = LOAD_OPTION_ACTIVE;
 			cursor += sizeof (UINT32);
 			*(UINT16 *)cursor = DevicePathSize(hddp);
diff --git a/include/hexdump.h b/include/hexdump.h
index 1a20339b..e8f4fe1a 100644
--- a/include/hexdump.h
+++ b/include/hexdump.h
@@ -71,7 +71,7 @@ prepare_text(const void *data, size_t size, char *buf, unsigned int position)
 		else
 			buf[offset++] = '.';
 	}
-	buf[offset++] = size > 0 ? '|' : 'X';
+	buf[offset++] = '|';
 	buf[offset] = '\0';
 }
 
@@ -89,6 +89,11 @@ vhexdumpf(const char *file, int line, const char *func, const CHAR16 *const fmt,
 	if (verbose == 0)
 		return;
 
+	if (!data || !size) {
+		dprint(L"hexdump of a NULL pointer!\n");
+		return;
+	}
+
 	while (offset < size) {
 		char hexbuf[49];
 		char txtbuf[19];
diff --git a/lib/variables.c b/lib/variables.c
index 3ec05478..8e63aa8f 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -68,6 +68,8 @@ fill_esl_with_one_signature(const uint8_t *data, const uint32_t data_len,
 
 	if (out) {
 		sd = AllocateZeroPool(sig_size);
+		if (!sd)
+			return EFI_OUT_OF_RESOURCES;
 		if (owner)
 			CopyMem(sd, (void *)owner, sizeof(EFI_GUID));
 		CopyMem(sd->SignatureData, (void *)data, data_len);
diff --git a/mok.c b/mok.c
index 52dffc3e..930e52a2 100644
--- a/mok.c
+++ b/mok.c
@@ -883,7 +883,9 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v,
 	}
 
 	dprint(L"maybe mirroring \"%s\".  original data:\n", v->name);
-	dhexdumpat(v->data, v->data_size, 0);
+	if (v->data && v->data_size) {
+		dhexdumpat(v->data, v->data_size, 0);
+	}
 
 	ret = maybe_mirror_one_mok_variable(v, ret, only_first);
 	dprint(L"returning %r\n", ret);
-- 
cgit v1.2.3


From d45c610ba558c1b1673ff94590b71a156dd2fd3c Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Wed, 12 Mar 2025 13:43:46 -0400
Subject: SetSecureVariable(): free Cert on failure

If variable_create_esl_with_one_signature() succeeds but
CreateTimeBasedPayload() fails, we leak the allocation for our
certificate.

This patch frees it.

Resolves: Coverity CID 457504
Signed-off-by: Peter Jones <pjones@redhat.com>
---
 lib/variables.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'lib/variables.c')

diff --git a/lib/variables.c b/lib/variables.c
index 8e63aa8f..1a2c7d48 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -226,6 +226,8 @@ SetSecureVariable(const CHAR16 * const var, UINT8 *Data, UINTN len,
 	}
 	efi_status = CreateTimeBasedPayload(&DataSize, (UINT8 **)&Cert);
 	if (EFI_ERROR(efi_status)) {
+		if (Cert && Cert != (EFI_SIGNATURE_LIST *)Data)
+			FreePool(Cert);
 		console_print(L"Failed to create time based payload %d\n",
 			      efi_status);
 		return efi_status;
-- 
cgit v1.2.3