diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-07-06 13:21:08 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-07-06 13:21:08 +0000 |
| commit | 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15 (patch) | |
| tree | 6ac1c7f30909e30d3b3cc317e0cec10e115a14b3 | |
| parent | c1b6ebc2b7584f93cea4d818468b2aee74475674 (diff) | |
dtrace: Fix DOF section bounds validation
We must ensure that each DOF section does not overlap with the DOF
header or section table. Otherwise the relocations processed in the
second pass over sections can manipulate DOF metadata, leading to OOB
writes.
Reviewed by: christos
MFC after: 2 weeks
Sponsored by: CHERI Research Centre
Differential Revision: https://reviews.freebsd.org/D57976
| -rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index d4c6c5ec449a..aa8716908cb1 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } + if (sec->dofs_offset < sizeof (dof_hdr_t)) { + dtrace_dof_error(dof, "section overlaps header"); + return (-1); + } + + if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff && + sec->dofs_offset < dof->dofh_secoff + + dof->dofh_secnum * dof->dofh_secsize) { + dtrace_dof_error(dof, "invalid section offset"); + return (-1); + } + if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr + sec->dofs_offset + sec->dofs_size - 1) != '\0') { dtrace_dof_error(dof, "non-terminating string table"); |