From nobody Mon Jul 27 22:32:37 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h8Cys4w08z6lyBP for ; Mon, 27 Jul 2026 22:32:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h8Cys1ww3z3CJX for ; Mon, 27 Jul 2026 22:32:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785191557; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SnDsoiyG507FTAwRGR85rJKbSfjRIEq9gA1ae/Ivjro=; b=DBHKPWd+JCcdCmC059uG9N+LKNL2w2VgheehxxA7ilbvUMOuqJbQUyjw/X9dPclC5lfPO8 8AHdA4t5f0JOsBjwAPwaAXXhZ12+zCXVG7vwPgTzAOj7JOKUvndgFEfDNHTa0bFeYmRhQN 867Bkue4qmZfP8oArQoYkymx/nSBliF14K0Kgl8SxrnvmfX8gyqUVzYIB6dgjigGD0Lg91 0igQeOrRyLS+OLWS/nQET6OBjzDIvDJdqjPezgefwXHI71J1CEX403OAJdC+qN83rSm5Nu OOUE/hOmM10L1OR3EW4VekpBobPK1DTzMjWeKMCEM+M/9LH2i33RNXq1KU1uGQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785191557; a=rsa-sha256; cv=none; b=f/GbxTyCMXf0BrC7TWOjaIL3fkdf479gTVjcflkPDG4iJtxBOavtKuwtHHZI3wV8zyNDNZ SBw6PqYKYgIs6hYZtKdm9jCvKMqkItvX1C4VUzwn6QGDrs6154IXsd9NfnYZ8xwpZBj1Hh IqWyGf3NeuP4Bp9rjtoSvS171iBFmH81KmJzDpkqWX0OtmPzykjUPORppXbpBkrag4AMaE /SOCFalYskPKK2W1GlkhLks037olR49IY3y7Gs5/a8rXeYFPxsFmaSlFDFaMyG+lctWODL l+dS3BSzxT9Qlk24jCvZVGRZkw33RKo+eFqKbqx5Bax02wmDYwAkggCH20kzjw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785191557; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SnDsoiyG507FTAwRGR85rJKbSfjRIEq9gA1ae/Ivjro=; b=QPo2Ggy8aUiwoS4cOazNey3aQKlNEFZmeiqzu4bnYwtd0jVmZIzITXhDsGcMNsaJaPxGtx +fsZoftOKYiH0WzA6pjfpEqCJhMQEnAC4wks+yhPh6m7+cMUjmPSRBKaz9OVJjZMWF71CQ 83YTMai8YMw8Bug0IneTB5BuQGO6/PGs9xMxtty78JTnaaPlfbqPVtnBkq+z4rY7ssDliY gd6nfTIgfAWr6I7p/RZW+Xl9lmba/OQ6vMDNtTCUDAK+cBPBHwNrtfmP8yZ1WoF938cTrO VqJ9N4rZxJwwKUIxYCGCc5X+d4El/U9vUzjkr1umVf6FcJ/EwoiDxP1JnZ2KtQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h8Cys0JxMz1QRB for ; Mon, 27 Jul 2026 22:32:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 25850 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 27 Jul 2026 22:32:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 8044d00cdda3 - stable/14 - dtrace: Improve DOF section size validation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 8044d00cdda3be5e5681d5a095b1c4a59e9594cd Auto-Submitted: auto-generated Date: Mon, 27 Jul 2026 22:32:37 +0000 Message-Id: <6a67dc85.25850.22d02bfb@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8044d00cdda3be5e5681d5a095b1c4a59e9594cd commit 8044d00cdda3be5e5681d5a095b1c4a59e9594cd Author: Mark Johnston AuthorDate: 2026-07-06 13:20:33 +0000 Commit: Mark Johnston CommitDate: 2026-07-27 14:05:07 +0000 dtrace: Improve DOF section size validation The loop which validates each DOF section assumes that the section header is present, so the section size must be at least as large as the header, otherwise a small OOB access is possible. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57975 (cherry picked from commit c1b6ebc2b7584f93cea4d818468b2aee74475674) --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index 853cfb845878..d4c6c5ec449a 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14201,8 +14201,8 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } - if (dof->dofh_secsize == 0) { - dtrace_dof_error(dof, "zero section header size"); + if (dof->dofh_secsize < sizeof (dof_sec_t)) { + dtrace_dof_error(dof, "invalid section header size"); return (-1); }