Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 031f2c6

Browse files
committed
uefi: memory safety fixes (UB!) in SNP Protocol
Parameter mutability was used in the wrong way. I also double-checked everything in the specification [0]. [0] https://uefi.org/specs/UEFI/2.10/24_Network_Protocols_SNP_PXE_BIS.html#efi-simple-network-nvdata 
1 parent 90c5ba4 commit 031f2c6

File tree

2 files changed

+13
-9
lines changed

2 files changed

+13
-9
lines changed

‎uefi/CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
image in QEMU or Cloud Hypervisor, when the debugcon/debug-console device is
2424
available.
2525
- The documentation for UEFI protocols has been streamlined and improved.
26+
- Fixed memory safety bug in `SimpleNetwork::read_nv_data`. The `buffer`
27+
parameter is now mutable.
2628

2729
# uefi - 0.35.0 (2025年05月04日)
2830

‎uefi/src/proto/network/snp.rs‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -142,30 +142,32 @@ impl SimpleNetwork {
142142
status.to_result_with_val(|| mac_address)
143143
}
144144

145-
/// Perform read operations on the NVRAM device attached to
146-
/// a network interface.
147-
pub fn read_nv_data(&self, offset: usize, buffer: &[u8]) -> Result {
145+
/// Reads data from the NVRAM device attached to the network interface into
146+
/// the provided `dst_buffer`.
147+
pub fn read_nv_data(&self, offset: usize, dst_buffer: &mut[u8]) -> Result {
148148
unsafe {
149149
(self.0.non_volatile_data)(
150150
&self.0,
151151
Boolean::from(true),
152152
offset,
153-
buffer.len(),
154-
buffer.as_ptr()as*mutc_void,
153+
dst_buffer.len(),
154+
dst_buffer.as_mut_ptr().cast(),
155155
)
156156
}
157157
.to_result()
158158
}
159159

160-
/// Perform write operations on the NVRAM device attached to a network interface.
161-
pub fn write_nv_data(&self, offset: usize, buffer: &mut [u8]) -> Result {
160+
/// Writes data into the NVRAM device attached to the network interface from
161+
/// the provided `src_buffer`.
162+
pub fn write_nv_data(&self, offset: usize, src_buffer: &[u8]) -> Result {
162163
unsafe {
163164
(self.0.non_volatile_data)(
164165
&self.0,
165166
Boolean::from(false),
166167
offset,
167-
buffer.len(),
168-
buffer.as_mut_ptr().cast(),
168+
src_buffer.len(),
169+
// SAFETY: The buffer is only used for reading.
170+
src_buffer.as_ptr().cast::<c_void>().cast_mut(),
169171
)
170172
}
171173
.to_result()

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /