RSDP search is slightly unsafe
Open
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 245
- Forks
- 93
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 15
Description
The BIOS-based RSDP search code doesn't take into account the RSDP 'length' field before calling validate(). Thus, it would be possible to cause the validate() routine to perform an out-of-bounds read during the BIOS-based search.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the BIOS-based RSDP search and its call to validate(), then trace how the RSDP length field is handled. Ensure validation cannot read beyond the available structure when the length is invalid, and add or run tests covering the malformed-length case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100