From nobody Mon Jul 6 13:28:27 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gv4tn5s49z6jX41 for ; Mon, 06 Jul 2026 13:28:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gv4tn053gz3rcn for ; Mon, 06 Jul 2026 13:28:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783344513; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=njoOOho6FbNM0kWd4jl16XoJ4oBRlrNM4uLggM9uOok=; b=N9GdluFWpKtPgeoD025d+gaV8iR+UC7wklJg95MuiVxlv9VV+GAgaLOxH3jaAzAE4oZLtH fQTS5sBaHtR/iYsI5RhtxK3O6mO4HnNtQTNVXCfZy72eZO1qAojhspXpBU3Zvcjc5IcPxo uVYFiitIxHsC8Zo1EktucRn5Bnxmw6LmCS84LzeYo5WD8SdH4iFXWAe4fPXoHtWgTRY24o uUsRGUmnX4LNrkCGL3o8f3NGte/XBxeD3nGss6kWYHjkGuEE3E3YBIQonIVHUNwumNQLOs UCToyUAoSSckfwpo+uBm/NafiK+jA5xYWOaAX+tFWb5ouwf/hIuMW1im15GTMw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783344513; a=rsa-sha256; cv=none; b=WgmG3sGwdB1Swn5piqbZlPWK8IVGV/DTRGedoVOqkGX8OZLCwv2WKQ/CXLeGZbTXasqbLZ SdQCDEjuOA6XMpHGpNS4Z5coOzeBIzsUYDxGDfQP8qrdHmQigrvz8pz3xeTCqZ3kbLEsIz Qe68D/axdXJ3K0SC05picU0etO/djfQEVIwimEje5CvoeJ0nveQqd23/zTM8FMfKSJfe9Z n9//WePWJ3spouoY3SBRksqgY/dmAp7tyxJzHoJnCKd6p4kyQdashww6boQyur4rBy6sB6 +lYFWm9Nty3bU/SSn8ffZlRY2HjrottxD3bkqGxmAIP7rt+tNyJ6/E0mcHLyEQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783344513; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=njoOOho6FbNM0kWd4jl16XoJ4oBRlrNM4uLggM9uOok=; b=BlPnQted5nXTdnLX7yo8qqmI0ZBSMLAs4QfX7NJss6goOm5puwjHFY9BaAtSW8ORKecHxK 6YIT3QfMpCvTK/Wmf0JVTRkM4MYXCN9BEEYvb5Xa7OObOktuEXUnZelVwiP6ZzDXo9/3ne uQD+tUvNrAqwOBO99pSOSkCHwzFszfqlW85R3eIICyOkRLZA46KVpu/lKc3M9SjtuVCHmz FAJNZcy9VqQp4Q+pVNonbn2k8GK5leHKppN/MG5ESRqhHHxQQ636NxJ2CzGTFh33gcoFec hJLgQP0iJPxAVqijocWbYltGRTAEdyvsnt3cUYmq8cgAI5h2IBIxDk4j7isG/g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gv4tm69Cdz15fJ for ; Mon, 06 Jul 2026 13:28:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 40f8e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 06 Jul 2026 13:28:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: c1b6ebc2b758 - main - dtrace: Improve DOF section size validation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c1b6ebc2b7584f93cea4d818468b2aee74475674 Auto-Submitted: auto-generated Date: Mon, 06 Jul 2026 13:28:27 +0000 Message-Id: <6a4bad7b.40f8e.50d68fb7@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c1b6ebc2b7584f93cea4d818468b2aee74475674 commit c1b6ebc2b7584f93cea4d818468b2aee74475674 Author: Mark Johnston AuthorDate: 2026-07-06 13:20:33 +0000 Commit: Mark Johnston CommitDate: 2026-07-06 13:20:33 +0000 dtrace: Improve DOF section size validation The loop which validates each DOF section assumes that the section header is present, so the section size must be at least as large as the header, otherwise a small OOB access is possible. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57975 --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index 853cfb845878..d4c6c5ec449a 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14201,8 +14201,8 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } - if (dof->dofh_secsize == 0) { - dtrace_dof_error(dof, "zero section header size"); + if (dof->dofh_secsize < sizeof (dof_sec_t)) { + dtrace_dof_error(dof, "invalid section header size"); return (-1); }