diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-07-06 13:20:33 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-07-06 13:20:33 +0000 |
| commit | c1b6ebc2b7584f93cea4d818468b2aee74475674 (patch) | |
| tree | 6fe62f95b2091a3d6644d41f8474b0527db5f1d5 | |
| parent | a8f5e24070a2fffc752ac7855bfb49049dcbb41e (diff) | |
dtrace: Improve DOF section size validation
The loop which validates each DOF section assumes that the section
header is present, so the section size must be at least as large as the
header, otherwise a small OOB access is possible.
Reviewed by: christos
MFC after: 2 weeks
Sponsored by: CHERI Research Centre
Differential Revision: https://reviews.freebsd.org/D57975
| -rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index 853cfb845878..d4c6c5ec449a 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14201,8 +14201,8 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } - if (dof->dofh_secsize == 0) { - dtrace_dof_error(dof, "zero section header size"); + if (dof->dofh_secsize < sizeof (dof_sec_t)) { + dtrace_dof_error(dof, "invalid section header size"); return (-1); } |