There are actually 2 separate bugs. The first is a bug in gnu-efi, triggered by this call in shim's errlog.c:
size = SPrint(NULL, 0, L"%a:%d %a() ", file, line, func);
According to the gnu-efi source, "A size of 0 means there is no limit", but SPrint does not check for NULL as the first parameter, and happily dereferences it anyway.
The other issue I've reported in LP: #1811901.
There are actually 2 separate bugs. The first is a bug in gnu-efi, triggered by this call in shim's errlog.c:
size = SPrint(NULL, 0, L"%a:%d %a() ", file, line, func);
According to the gnu-efi source, "A size of 0 means there is no limit", but SPrint does not check for NULL as the first parameter, and happily dereferences it anyway.
The other issue I've reported in LP: #1811901.