diff options
| author | Osvaldo Janeri Filho <ojanerif@amd.com> | 2026-11-08 16:45:01 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-11-08 16:45:04 +0000 |
| commit | 097f6d7a573369503ef5b8503fb2b721a6f66d85 (patch) | |
| tree | fbbab069b7e5f44933449fb363fbbbcfd359e68d /sys/kern/subr_sglist.c | |
| parent | 8e7f9aa97b3e886afc2c445bb51c4d781a106a1e (diff) | |
link_elf_load_file() checks the symbol table's sh_link against
e_shnum with ">" instead of ">=", so a malformed object whose sh_link
equals e_shnum makes the linker read one entry past the section header
array before the sh_type check rejects it. Use ">=", as
link_elf_link_preload() already does.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61055
Diffstat (limited to 'sys/kern/subr_sglist.c')
0 files changed, 0 insertions, 0 deletions
