boot: Fix OOB reads in conf/osrel parsing

src/boot/efi/efi-string.c

@@ -444,7 +444,7 @@ char *line_get_key_value(char *s, const char *sep, size_t *pos, char **ret_key,
                 line[linelen] = '\0';
 
                 /* remove leading whitespace */
-                while (strchr8(" \t", *line)) {
+                while (linelen > 0 && strchr8(" \t", *line)) {
                         line++;
                         linelen--;
                 }

src/boot/efi/test-efi-string.c

@@ -520,7 +520,9 @@ TEST(line_get_key_value) {
         char *key, *value;
 
         assert_se(!line_get_key_value((char[]){ "" }, "=", &pos, &key, &value));
+        assert_se(!line_get_key_value((char[]){ "\t" }, " \t", &pos, &key, &value));
 
+        pos = 0;
         assert_se(line_get_key_value(s1, "=", &pos, &key, &value));
         assert_se(streq8(key, "key"));
         assert_se(streq8(value, "value"));