Date: Mon, 27 Jul 2026 19:14:57 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 0c829bb55a86 - stable/15 - dtrace: Fix DOF section bounds validation Message-ID: <6a67ae31.36c43.75772c5a@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0c829bb55a86b696e6a6c66da28d856cb5c06772 commit 0c829bb55a86b696e6a6c66da28d856cb5c06772 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2026-07-06 13:21:08 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-07-27 17:34:31 +0000 dtrace: Fix DOF section bounds validation We must ensure that each DOF section does not overlap with the DOF header or section table. Otherwise the relocations processed in the second pass over sections can manipulate DOF metadata, leading to OOB writes. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57976 (cherry picked from commit 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15) --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index d4c6c5ec449a..aa8716908cb1 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } + if (sec->dofs_offset < sizeof (dof_hdr_t)) { + dtrace_dof_error(dof, "section overlaps header"); + return (-1); + } + + if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff && + sec->dofs_offset < dof->dofh_secoff + + dof->dofh_secnum * dof->dofh_secsize) { + dtrace_dof_error(dof, "invalid section offset"); + return (-1); + } + if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr + sec->dofs_offset + sec->dofs_size - 1) != '\0') { dtrace_dof_error(dof, "non-terminating string table");home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a67ae31.36c43.75772c5a>