link_elf_obj: validate section name offsetsHEADmain

A section name offset (sh_name) indexes the section name string table
without being checked against shstrcnt, and the result is passed to
strcmp(), so a corrupt object causes an out-of-bounds read.  Check that
the table is NUL-terminated and that every sh_name lies within it, in
both the preload and file paths, and reject the object with ENOEXEC.

Reviewed by:	kib
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D61338

0 files changed, 0 insertions, 0 deletions