From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Fri, 26 Jun 2026 18:41:31 +0000 (+0100)
Subject: boot: don't unquote an empty value in line_get_key_value()
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7378b51f66e8e7e87aa026b2ba2c7c785a0a509d;p=thirdparty%2Fsystemd.git

boot: don't unquote an empty value in line_get_key_value()

de0da85d41b switched the unquote check to strchr8(QUOTES, value[0]),
which is not equivalent to the old explicit comparison for an empty
value: strchr8(), like strchr(3), returns a pointer to the haystack's
terminating NUL when the needle is '\0', so strchr8(QUOTES, '\0') is
non-NULL. For a line whose separator is the last byte (e.g. "ID=") the
split leaves value[0] == '\0' and line[linelen - 1] == '\0' too, so both
conjuncts hold and value++ steps one byte past the value's terminator.

Follow-up for de0da85d41b207b850aa0f68bb2436525389cf2b
---

diff --git a/src/boot/efi-string.c b/src/boot/efi-string.c
index 30644638627..efe1553696d 100644
--- a/src/boot/efi-string.c
+++ b/src/boot/efi-string.c
@@ -500,7 +500,7 @@ char* line_get_key_value(char *s, const char *sep, size_t *pos, char **ret_key,
                         value++;
 
                 /* unquote */
-                if (strchr8(QUOTES, value[0]) && line[linelen - 1] == value[0]) {
+                if (value[0] != '\0' && strchr8(QUOTES, value[0]) && line[linelen - 1] == value[0]) {
                         value++;
                         line[linelen - 1] = '\0';
                 }
diff --git a/src/boot/test-efi-string.c b/src/boot/test-efi-string.c
index 7633534dd4c..5805cb30241 100644
--- a/src/boot/test-efi-string.c
+++ b/src/boot/test-efi-string.c
@@ -590,6 +590,7 @@ TEST(line_get_key_value) {
                     "  also\tused  \r\n"
                     "for \"the conf\"\n"
                     "format\t !!";
+        char s3[] = "ID=";
         size_t pos = 0;
         char *key, *value;
 
@@ -611,6 +612,11 @@ TEST(line_get_key_value) {
         ASSERT_TRUE(streq8(value, " stripping  # with comments"));
         ASSERT_NULL(line_get_key_value(s1, "=", &pos, &key, &value));
 
+        pos = 0;
+        ASSERT_NOT_NULL(line_get_key_value(s3, "=", &pos, &key, &value));
+        ASSERT_TRUE(streq8(key, "ID"));
+        ASSERT_TRUE(streq8(value, ""));
+
         pos = 0;
         ASSERT_NOT_NULL(line_get_key_value(s2, " \t", &pos, &key, &value));
         ASSERT_TRUE(streq8(key, "this"));