From 0096c83c5d831c363ba0d2b7d1dfc6ec33de8ab4 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Mon, 18 May 2026 00:17:27 +0100
Subject: [PATCH] boot: fix off-by-one truncation when reading efivars

'val' is allocated as 'size + 1', so the NUL terminator must be written
to 'size', rather than 'size - 1'.

Follow-up for fab82756462fd0ce82836e3d95721954d7ab2527
---
 src/boot/efi-efivars.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/boot/efi-efivars.c b/src/boot/efi-efivars.c
index 5581d98ec3..c1ae4252c3 100644
--- a/src/boot/efi-efivars.c
+++ b/src/boot/efi-efivars.c
@@ -106,7 +106,7 @@ EFI_STATUS efivar_get_str16(const EFI_GUID *vendor, const char16_t *name, char16
         val = xmalloc(size + sizeof(char16_t));
 
         memcpy(val, buf, size);
-        val[size / sizeof(char16_t) - 1] = 0; /* NUL terminate */
+        val[size / sizeof(char16_t)] = 0; /* NUL terminate */
 
         *ret = val;
         return EFI_SUCCESS;