potential OOB in redux_uefi_std

crates/redox_uefi_std/RUSTSEC-0000-0000.md

@@ -0,0 +1,47 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "redox_uefi_std"
+date = "2025-03-27"
+url = "https://gitlab.redox-os.org/redox-os/uefi/-/tree/master/crates/uefi_std"
+informational = "unsound"
+categories = ["memory-corruption"]
+keywords = ["out-of-bounds read"]
+
+```
+
+# Safe API can cause heap-buffer-overflow
+
+In redox_uefi_std's src/ffi.rs:
+```rust
+pub fn nstr(wstring: *const u16) -> String {
+    let mut string = String::new();
+
+    let mut i = 0;
+    loop {
+        let w = unsafe { *wstring.offset(i) };
+        i += 1;
+        if w == 0 {
+            break;
+        }
+        let c = unsafe { char::from_u32_unchecked(w as u32) };
+        string.push(c);
+    }
+
+    string
+}
+```
+
+Any non-zero ended array of type-mimatch(casted from u8  array) can easily cause heap buffer overflow
+```example
+fn main() {
+  let wstring:Vec<u16> = vec![0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x12];
+  let wstring_ptr = wstring.as_ptr() as *const u16;
+  let string = nstr(wstring_ptr);
+}
+```
+
+ASAN output
+```
+==1219432==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000014 at pc 0x55c4566796c2 bp 0x7ffc1f81e530 sp 0x7ffc1f81e528
+```