From 56cad12011eaca88ccd13fd86b1521c6bc2fa25e Mon Sep 17 00:00:00 2001 From: Vignesh G Date: Wed, 17 Jun 2026 13:22:43 +0530 Subject: [PATCH] SecurityPkg: Add sanity check for File and FileBuffer inputs Ensure that either File or FileBuffer is provided before proceeding with security verification. If both are NULL, return EFI_INVALID_PARAMETER. This prevents verification from running without a valid input buffer and aligns with the intended design, where File is optional and FileBuffer alone is sufficient. Signed-off-by: Vignesh G --- .../DxeImageVerificationLib/DxeImageVerificationLib.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c index 46d39cd96f..f928700008 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c @@ -1705,9 +1705,13 @@ DxeImageVerificationHandler ( IsFoundInDatabase = FALSE; // - // Sanity check + // Sanity check: + // Ensure that either File or FileBuffer is provided. + // Return EFI_INVALID_PARAMETER if both are NULL. + // This prevents security verification from proceeding + // when no valid input buffer is available. // - if (File == NULL) { + if ((File == NULL) && (FileBuffer == NULL)) { return EFI_INVALID_PARAMETER; }