Commit Graph

2 Commits

Author SHA1 Message Date
Michael Brown
e5e2f3fba8 [efi] Fix memory copy length used in efi_nullify_name2()
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-10-27 11:43:08 +00:00
Michael Brown
5b41b9a80f [efi] Nullify interfaces and leak memory on uninstallation failure
The UEFI specification allows uninstallation of a protocol interface
to fail.  There is no sensible way for code to react to this, since
uninstallation is likely to be taking place on a code path that cannot
itself fail (e.g. a code path that is itself a failure path).

Where the protocol structure exists within a dynamically allocated
block of memory, this leads to possible use-after-free bugs.  Work
around this unfortunate design choice by nullifying the protocol
(i.e. overwriting the method pointers with no-ops) and leaking the
memory containing the protocol structure.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-10-26 15:24:00 +00:00