Date: Mon, 06 Jul 2026 13:28:27 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: c1b6ebc2b758 - main - dtrace: Improve DOF section size validation Message-ID: <6a4bad7b.40f8e.50d68fb7@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c1b6ebc2b7584f93cea4d818468b2aee74475674 commit c1b6ebc2b7584f93cea4d818468b2aee74475674 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2026-07-06 13:20:33 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-07-06 13:20:33 +0000 dtrace: Improve DOF section size validation The loop which validates each DOF section assumes that the section header is present, so the section size must be at least as large as the header, otherwise a small OOB access is possible. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57975 --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index 853cfb845878..d4c6c5ec449a 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14201,8 +14201,8 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } - if (dof->dofh_secsize == 0) { - dtrace_dof_error(dof, "zero section header size"); + if (dof->dofh_secsize < sizeof (dof_sec_t)) { + dtrace_dof_error(dof, "invalid section header size"); return (-1); }home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a4bad7b.40f8e.50d68fb7>