Reject the binary when there is no key in MokList

diff --git a/shim.c b/shim.c
index 43297297ff01e74ea5fdee4ac3b25544611bc9c0..73b2feb79f6da76999660ec60b33c418279d1097 100644 (file)
--- a/shim.c
+++ b/shim.c
@@ -617,8 +617,10 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
        }
 
        CopyMem(&MokNum, MokListData, sizeof(UINT32));
-       if (MokNum == 0)
+       if (MokNum == 0) {
+               status = EFI_ACCESS_DENIED;
                goto done;
+       }
 
        list = build_mok_list(MokNum,
                              (void *)MokListData + sizeof(UINT32),