diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-07-06 13:21:24 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-07-06 13:21:24 +0000 |
| commit | b56b601c5ba603031312b9bc7ae895ecb0dcdaec (patch) | |
| tree | 91308f8612135026222a69b8ddf8decd07bffa87 | |
| parent | 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15 (diff) | |
dtrace: Improve DOF string table validation
The check for a nul terminator implicitly assumes that the section size
is positive. Make the assumption explicit.
Reviewed by: christos
MFC after: 2 weeks
Sponsored by: CHERI Research Centre
Differential Revision: https://reviews.freebsd.org/D57977
| -rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index aa8716908cb1..ff31d806664b 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14288,8 +14288,9 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } - if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr + - sec->dofs_offset + sec->dofs_size - 1) != '\0') { + if (sec->dofs_type == DOF_SECT_STRTAB && (sec->dofs_size == 0 || + *((char *)daddr + sec->dofs_offset + sec->dofs_size - 1) != + '\0')) { dtrace_dof_error(dof, "non-terminating string table"); return (-1); } |