Closed
Description
These impls were added in uefi-0.29.0, I missed a safety issue when reviewing the code.
The current impls look like this:
impl<'a> TryFrom<&[u8]> for &'a DevicePath { ... }
But they should look like this:
impl<'a> TryFrom<&'a [u8]> for &'a DevicePath { ... }
This wasn't caught by the compiler because internally these impls use unsafe
pointer-based code. The missing lifetime means that the &[u8]
buffer can be free'd while the &DevicePath
still exists, which is UB.
The fix is straightforward, I will put up a PR. I think we should also do a 0.29.1
release since we're not quite ready for a 0.30.0 release yet. EDIT: actually, this is a semver-incompatible change, so it should be a 0.30.0 release. We can branch this off of commit 4e4e190.
cc @andre-braga
Metadata
Metadata
Assignees
Labels
No labels