diff options
| author | John Baldwin <jhb@FreeBSD.org> | 2026-07-31 17:52:56 +0000 |
|---|---|---|
| committer | John Baldwin <jhb@FreeBSD.org> | 2026-10-08 20:42:32 +0000 |
| commit | 6e4ef01c603c5745922902b42652125720adaa9c (patch) | |
| tree | 14eae360cc551575d7c7e90aa01d51f60079247f | |
| parent | 999ce4475a0199577e5b08fce12624df0e38d0c6 (diff) | |
stand: Reject ELF files with PT_LOAD segments where filesz > memsz
Reviewed by: jrtc27, kib
Differential Revision: https://reviews.freebsd.org/D58543
(cherry picked from commit c7400fe1df4e971670a7628ddcc856f7a6775dc6)
| -rw-r--r-- | stand/common/load_elf.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/stand/common/load_elf.c b/stand/common/load_elf.c index 3db513435271..3b78007be816 100644 --- a/stand/common/load_elf.c +++ b/stand/common/load_elf.c @@ -635,6 +635,12 @@ __elfN(loadimage)(struct preloaded_file *fp, elf_file_t ef, uint64_t off) if (phdr[i].p_type != PT_LOAD) continue; + if (phdr[i].p_memsz < phdr[i].p_filesz) { + printf("elf" __XSTRING(__ELF_WORD_SIZE) + "_loadimage: invalid PT_LOAD segment\n"); + goto out; + } + if (module_verbose >= MODULE_VERBOSE_FULL) { printf("Segment: 0x%lx@0x%lx -> 0x%lx-0x%lx", (long)phdr[i].p_filesz, (long)phdr[i].p_offset, |