rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.  The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.

Reviewed by:	jrtc27, kib
Differential Revision:	https://reviews.freebsd.org/D58541

2 files changed, 18 insertions, 0 deletions

diff --git a/libexec/rtld-elf/map_object.c b/libexec/rtld-elf/map_object.c
index 6f8160e003d7..81ed62d99a18 100644
--- a/libexec/rtld-elf/map_object.c
+++ b/libexec/rtld-elf/map_object.c
@@ -121,6 +121,12 @@ map_object(int fd, const char *path, const struct stat *sb, bool ismain)
 			break;
 
 		case PT_LOAD:
+			if (phdr->p_memsz < phdr->p_filesz) {
+				_rtld_error("%s: invalid PT_LOAD segment",
+				    path);
+				goto error;
+			}
+
 			segs[++nsegs] = phdr;
 			if ((segs[nsegs]->p_align & (page_size - 1)) != 0) {
 				_rtld_error(
@@ -140,6 +146,12 @@ map_object(int fd, const char *path, const struct stat *sb, bool ismain)
 			break;
 
 		case PT_TLS:
+			if (phdr->p_memsz < phdr->p_filesz) {
+				_rtld_error("%s: invalid PT_TLS segment",
+				    path);
+				goto error;
+			}
+
 			phtls = phdr;
 			break;
 
diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c
index 864148df99ba..bb4314c03039 100644
--- a/libexec/rtld-elf/rtld.c
+++ b/libexec/rtld-elf/rtld.c
@@ -1748,6 +1748,12 @@ digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path)
 			break;
 
 		case PT_TLS:
+			if (ph->p_memsz < ph->p_filesz) {
+				_rtld_error("%s: invalid PT_TLS segment",
+				    path);
+				return (NULL);
+			}
+
 			obj->tlsindex = 1;
 			obj->tlssize = ph->p_memsz;
 			obj->tlsalign = ph->p_align;