From nobody Mon Jul 6 13:28:27 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gv4tg72TFz6jXtb for ; Mon, 06 Jul 2026 13:28:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gv4tg6FtRz3rZG for ; Mon, 06 Jul 2026 13:28:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783344507; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=njoOOho6FbNM0kWd4jl16XoJ4oBRlrNM4uLggM9uOok=; b=YCf9KlgordBU4Imq38SEoCyBVO04CidKHjc2fOTrBv8tekHFRuvKJnIwK0sNkY6xoQ0L9E afbS22hofaYsk4KvP2K0MVTeRuQUspr3hTFNWiFP6P5khJipNXSSnalQKLxokS0ewuLGBI pjBtTtl/2Ma/0FubTZl2AA55QGm4ql+vazpuSKx4I3TGd47EN4ADELVzPPte5jd2SBVZzY Pn4E0tNi3/NSiqhGSYQxDIHcS9j+Nn1+euNR/gLwPQHAgESWwKbm0V+AoW1dE00rMB0Two vUqeu6KtheDvySZe6PRd0elbubfz7ULOsm3m9ZwLqcweYY2QjE/XdSDArPxTkA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783344507; a=rsa-sha256; cv=none; b=HSHQI0K+QFSUrCG7zdCQj+B8jy1vQia4xWeMjxWep8TPrX7bKQVyHteLPRUJMnt/fZI4I3 cJeiyTSz2DkGd2RdjHUzYy7cY/nAhLNjBuFPhuZq7PqW/bPiHJy5kEuSsl7iLdbX49DRtH clEexC3dVrLVZahNL27VMEinvuNQ2Q64u2QHgcj8TxjqtKUGdCvHi+1IpAn7TBxAlMHyBf gG6h44Ra7+i5WJXRNXFVxUmaLJZffDupj0oYYfw9L3ITtqwrl6gkXzZW3hcpS8RNqDoYwn Hg1Nq6iTENNHeIX0WQ3v5U3KDf21zue7GIawhltZOQjhjs7enTCPdj0A0484FQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783344507; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=njoOOho6FbNM0kWd4jl16XoJ4oBRlrNM4uLggM9uOok=; b=RQhYnu9wHzm2YdDDLpykAMukNposrZNEdkDgslLR5amJGjLGhSIguyXJp2lmz5U3QP5SKz Oq2cUcBoqHchz3QS0voa0BtvwouDyn1xnPFUVln6zA+cY6812BDGNLIMjfyjP/kK2+Lr6Q w7efmcI0YcHmJU+uC1SxnnK7uqCKbv9YyVLuEscGfRhzbTAdBKsQmCPlKMBQeHk87UbL8P KCfpNsepL4XfftJKVwyROIYRxWcVlov0V2yfyGbDEvbPYYq5BwkHFyNTxTc7sGH2uparxv nWoEJGgztQyvFsdRFtpxbPWupumRpsJ1aNofqE6F42JOMDMNRYpN/CIJ3FqGYg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gv4tg52nsz14w0 for ; Mon, 06 Jul 2026 13:28:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 40f8e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 06 Jul 2026 13:28:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: c1b6ebc2b758 - main - dtrace: Improve DOF section size validation List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c1b6ebc2b7584f93cea4d818468b2aee74475674 Auto-Submitted: auto-generated Date: Mon, 06 Jul 2026 13:28:27 +0000 Message-Id: <6a4bad7b.40f8e.50d68fb7@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c1b6ebc2b7584f93cea4d818468b2aee74475674 commit c1b6ebc2b7584f93cea4d818468b2aee74475674 Author: Mark Johnston AuthorDate: 2026-07-06 13:20:33 +0000 Commit: Mark Johnston CommitDate: 2026-07-06 13:20:33 +0000 dtrace: Improve DOF section size validation The loop which validates each DOF section assumes that the section header is present, so the section size must be at least as large as the header, otherwise a small OOB access is possible. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57975 --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index 853cfb845878..d4c6c5ec449a 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14201,8 +14201,8 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } - if (dof->dofh_secsize == 0) { - dtrace_dof_error(dof, "zero section header size"); + if (dof->dofh_secsize < sizeof (dof_sec_t)) { + dtrace_dof_error(dof, "invalid section header size"); return (-1); }