From 8c8ade58260bfe78d4eb5e3b31406a83cc461a85 Mon Sep 17 00:00:00 2001 From: dilluti0n Date: Mon, 13 Jul 2026 23:10:42 +0900 Subject: [PATCH 1/3] Fix dangling pointer in WinDivert::uninstall() MaybeUninit::uninit() is not bound to any variable, so the temporary is dropped at the end of the statement, leaving `status` as a dangling pointer into the freed stack slot. Passing it to ControlService() as an out-pointer then makes the kernel write through a dangling pointer, which is undefined behavior. Bind the MaybeUninit to a local so it outlives the pointer. --- windivert/src/divert/mod.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windivert/src/divert/mod.rs b/windivert/src/divert/mod.rs index 66e65a9..a202cde 100644 --- a/windivert/src/divert/mod.rs +++ b/windivert/src/divert/mod.rs @@ -189,7 +189,7 @@ impl WinDivert<()> { /// Method that tries to uninstall WinDivert driver. pub fn uninstall() -> WinResult<()> { - let status: *mut SERVICE_STATUS = MaybeUninit::uninit().as_mut_ptr(); + let mut status = MaybeUninit::::uninit(); unsafe { let manager = OpenSCManagerA(None, None, SC_MANAGER_ALL_ACCESS)?; let service = OpenServiceA( @@ -197,7 +197,7 @@ impl WinDivert<()> { PCSTR::from_raw("WinDivert".as_ptr()), SC_MANAGER_ALL_ACCESS, )?; - let res = ControlService(service, SERVICE_CONTROL_STOP, status); + let res = ControlService(service, SERVICE_CONTROL_STOP, status.as_mut_ptr()); if !res.as_bool() { return Err(WinError::from(GetLastError())); } From cd14ebce2470ae80d7b81a220f6b9ec89ca61e84 Mon Sep 17 00:00:00 2001 From: dilluti0n Date: Mon, 13 Jul 2026 23:33:43 +0900 Subject: [PATCH 2/3] Fix rust str passed as ptr to C ffi This should be null terminated or OpenServiceA() have no chance to know where str is stopped. --- windivert/src/divert/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windivert/src/divert/mod.rs b/windivert/src/divert/mod.rs index a202cde..e2b5793 100644 --- a/windivert/src/divert/mod.rs +++ b/windivert/src/divert/mod.rs @@ -194,7 +194,7 @@ impl WinDivert<()> { let manager = OpenSCManagerA(None, None, SC_MANAGER_ALL_ACCESS)?; let service = OpenServiceA( manager, - PCSTR::from_raw("WinDivert".as_ptr()), + PCSTR::from_raw("WinDivert\0".as_ptr()), SC_MANAGER_ALL_ACCESS, )?; let res = ControlService(service, SERVICE_CONTROL_STOP, status.as_mut_ptr()); From 389e1443bafa0f55d60570276dec8e02732b9bd2 Mon Sep 17 00:00:00 2001 From: dilluti0n Date: Thu, 16 Jul 2026 15:51:37 +0900 Subject: [PATCH 3/3] Bump msrv to 1.71 --- .github/workflows/check.yml | 2 +- windivert-sys/Cargo.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index ccead35..48f57d8 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -92,7 +92,7 @@ jobs: strategy: fail-fast: false matrix: - msrv: ["1.68"] + msrv: ["1.71"] steps: - uses: actions/checkout@v4 with: diff --git a/windivert-sys/Cargo.toml b/windivert-sys/Cargo.toml index ebe181b..bdd8b3e 100644 --- a/windivert-sys/Cargo.toml +++ b/windivert-sys/Cargo.toml @@ -11,7 +11,7 @@ categories = ["external-ffi-bindings"] readme = "../README.md" license = "LGPL-3.0-or-later" edition = "2021" -rust-version = "1.68" +rust-version = "1.71" links = "WinDivert" build = "build/main.rs"