Skip to content

Check the size field of UEFI file info before using it - #164956

Closed
yashaggarwal85d wants to merge 1 commit into
rust-lang:mainfrom
yashaggarwal85d:uefi-check-file-info-size
Closed

yashaggarwal85d wants to merge 1 commit into
rust-lang:mainfrom
yashaggarwal85d:uefi-check-file-info-size

Conversation

@yashaggarwal85d

@yashaggarwal85d yashaggarwal85d commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

read_dir_entry and file_info take the size field the firmware writes into file::Info and
use it to slice the file name. A bad size can underflow, point past the buffer, or make
file_name_from_uefi panic on an empty name. This checks it's at least the header plus a NUL
and not bigger than what we allocated, and returns InvalidData otherwise.

Fixes #164944

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Oct 26, 2026
@rustbot

rustbot commented Oct 26, 2026

Copy link
Copy Markdown
Collaborator

r? @Mark-Simulacrum

rustbot has assigned @Mark-Simulacrum.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

  • Owners of files modified in this PR: @ChrisDenton, libs
  • @ChrisDenton, libs expanded to 37 candidates
  • Random selection from ChrisDenton, JohnTitor, Mark-Simulacrum, aapoalas, thomcc

@joboet

joboet commented Oct 26, 2026

Copy link
Copy Markdown
Member

Closing along with the issue...

@joboet joboet closed this Oct 26, 2026
@rustbot rustbot removed the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

T-libs Relevant to the library team, which will review and decide on the PR/issue.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

UEFI: unchecked firmware-written Size field in UefiBox<file::Info>::file_name_len causes OOB read via safe fs::read_dir

4 participants