diff options
| author | John Baldwin <jhb@FreeBSD.org> | 2026-07-31 17:52:56 +0000 |
|---|---|---|
| committer | John Baldwin <jhb@FreeBSD.org> | 2026-07-31 17:52:56 +0000 |
| commit | c7400fe1df4e971670a7628ddcc856f7a6775dc6 (patch) | |
| tree | 00dbba6ac4f4cc1934539aa07d6277d0d6391568 | |
| parent | 486dfbb67e093a461a5ebd97f66be9b345f9de77 (diff) | |
stand: Reject ELF files with PT_LOAD segments where filesz > memsz
Reviewed by: jrtc27, kib
Differential Revision: https://reviews.freebsd.org/D58543
| -rw-r--r-- | stand/common/load_elf.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/stand/common/load_elf.c b/stand/common/load_elf.c index 14fc0893f088..d0cdf425f0f0 100644 --- a/stand/common/load_elf.c +++ b/stand/common/load_elf.c @@ -636,6 +636,12 @@ __elfN(loadimage)(struct preloaded_file *fp, elf_file_t ef, uint64_t off) if (phdr[i].p_type != PT_LOAD) continue; + if (phdr[i].p_memsz < phdr[i].p_filesz) { + printf("elf" __XSTRING(__ELF_WORD_SIZE) + "_loadimage: invalid PT_LOAD segment\n"); + goto out; + } + if (module_verbose >= MODULE_VERBOSE_FULL) { printf("Segment: 0x%lx@0x%lx -> 0x%lx-0x%lx", (long)phdr[i].p_filesz, (long)phdr[i].p_offset, |