Tianocore/edk2.git/SecurityPkg/Library/AuthVariableLib, branch master

SecurityPkg: Fix wider-type comparisons

2026-09-08T18:20:17+00:00

Makes changes to comply with CodeQL comparison-with-wider-type alerts. Some of these have safe patterns even with wider type comparisons, so an explicit cast is used to make the intention clear and silence the failure. Signed-off-by: Oliver Smith-Denny

SecurityPkg/AuthVariableLib: harden signature list filtering

2026-06-30T02:35:17+00:00

Signed-off-by: 20000419

SecurityPkg: AuthVariableLib: Handle empty signature lists

2026-03-10T06:33:40+00:00

The current implementation fails to set authenticated variables when the signature list is empty. This can legitimately occur for dbx when no signatures are revoked after a certificate rotation. Update the logic to explicitly handle empty signature lists, avoiding an implicit dependency on the variable being absent from variable storage. Signed-off-by: Kun Qin

SecurityPkg: Replace include guards with #pragma once

2026-02-23T21:01:28+00:00

Replace traditional `#ifndef`/`#define`/`#endif` include guards with `#pragma` once. `#pragma once` is a widely supported preprocessor directive that prevents header files from being included multiple times. It is supported by all toolchains used to build edk2: GCC, Clang/LLVM, and MSVC. Compared to macro-based include guards, `#pragma once`: - Eliminates the risk of macro name collisions or copy/paste errors where two headers inadvertently use the same guard macro. - Eliminate inconsistency in the way include guard macros are named (e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.). - Reduces boilerplate (three lines replaced by one). - Avoids polluting the macro namespace with guard symbols. - Can improve build times as the preprocessor can skip re-opening the file entirely, rather than re-reading it to find the matching `#endif` ("multiple-include optimization"). - Note that some compilers may already optimize traditional include guards, by recognzining the idiomatic pattern. This change is made acknowledging that overall portability of the code will technically be reduced, as `#pragma once` is not part of the C/C++ standards. However, this is considered acceptable given: 1. edk2 already defines a subset of supported compilers in BaseTools/Conf/tools_def.template, all of which have supported `#pragma once` for over two decades. 2. There have been concerns raised to the project about inconsistent include guard naming and potential macro collisions. Approximate compiler support dates: - MSVC: Supported since Visual C++ 4.2 (1996) - GCC: Supported since 3.4 (2004) (http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html) - Clang (LLVM based): Since initial release in 2007 Signed-off-by: Michael Kubacki

Revert "SecurityPkg: CodeQL Fixes."

2025-08-12T03:50:30+00:00

This reverts commit ba6a8eb045aededbc1472cce7314ab1911f0ea1c. PR https://github.com/tianocore/edk2/pull/11307 introduced a logic change that caused regressions in FV verification on some platforms. This PR is being reverted to restore the prior logic. The Code QL fixes in https://github.com/tianocore/edk2/pull/11307 can be resubmitted without the logic change along with one commit for each type of Code QL issue being addressed. Signed-off-by: Michael D Kinney

SecurityPkg: CodeQL Fixes.

2025-07-24T01:58:06+00:00

Makes changes to comply with alerts raised by CodeQL. Most of the issues here fall into the following two categories: 1. Potential use of uninitialized pointer. 2. Inconsistent integer width in comparison. Co-authored-by: Taylor Beebe <31827475+TaylorBeebe@users.noreply.github.com> Co-authored-by: kenlautner <85201046+kenlautner@users.noreply.github.com> Co-authored-by: Bret Barkelew Signed-off-by: Doug Flick

Remove unnecessary RsaFree call in failing path

2025-04-17T04:11:48+00:00

Signed-off-by: Anbazhagan Baraneedharan

SecurityPkg/AuthVariableLib: Fix memory leak in CheckSignatureListFormat

2025-04-17T04:11:48+00:00

RsaGetPublicKeyFromX509 allocates memory for RsaContext parameter and the memory allocated earlier is not necessary Signed-off-by: Anbazhagan Baraneedharan

SecurityPkg/SecureBoot: Support RSA4096 and RSA3072

2023-09-07T06:12:18+00:00

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3413 Cc: Jiewen Yao Cc: Jian J Wang Cc: Min Xu Cc: Zeyi Chen Cc: Fiona Wang Signed-off-by: Sheng Wei Reviewed-by: Jiewen Yao

SecurityPkg: Update code to be more C11 compliant by using func

2023-04-10T14:19:57+00:00

__FUNCTION__ is a pre-standard extension that gcc and Visual C++ among others support, while __func__ was standardized in C99. Since it's more standard, replace __FUNCTION__ with __func__ throughout SecurityPkg. Signed-off-by: Rebecca Cran Reviewed-by: Michael D Kinney Reviewed-by: Ard Biesheuvel