coredump: Don't assume that the number of ELF segments is consistent

In an ELF coredump, each dumped vm_map_entry is represented by a
segment.  __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.

each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls.  If the map is shared with another
process, via rfork(), then the map can change.  cb_put_phdr() did not
account for this, and so could write out of bounds.

Add a check to prevent this; simply do not write out excess segments.

Approved by:	so
Security:	FreeBSD-SA-26:55.elf
Security:	CVE-2026-58088
Reported by:	Maik Muench of Secfault Security
Reviewed by:	kib, emaste
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D58416

0 files changed, 0 insertions, 0 deletions