Merge pull request #1550 from nicholasbishop/bishop-fix-snp-len

uefi: Fix the BufferSize argument in SimpleNetwork::transmit
rust-osdev · Feb 17, 2025 · 470a1ed · 470a1ed
2 parents fd72002 + 86c8039
commit 470a1ed
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/uefi/CHANGELOG.md b/uefi/CHANGELOG.md
@@ -7,6 +7,9 @@
 - `boot::memory_map()` will never return `Status::BUFFER_TOO_SMALL` from now on,
   as this is considered a hard internal error where users can't do anything
   about it anyway. It will panic instead.
+- `SimpleNetwork::transmit` now passes the correct buffer size argument.
+  Previously it incorrectly added the header size to the buffer length, which
+  could cause the firmware to read past the end of the buffer.
 
 
 # uefi - 0.34.1 (2025-02-07)

diff --git a/uefi/src/proto/network/snp.rs b/uefi/src/proto/network/snp.rs
@@ -225,7 +225,7 @@ impl SimpleNetwork {
         (self.transmit)(
             self,
             header_size,
-            buffer.len() + header_size,
+            buffer.len(),
             buffer.as_ptr().cast(),
             src_addr.as_ref(),
             dest_addr.as_ref(),