The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15
commit 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15 Author: Mark Johnston <[email protected]> AuthorDate: 2026-07-06 13:21:08 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-07-06 13:21:08 +0000 dtrace: Fix DOF section bounds validation We must ensure that each DOF section does not overlap with the DOF header or section table. Otherwise the relocations processed in the second pass over sections can manipulate DOF metadata, leading to OOB writes. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57976 --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index d4c6c5ec449a..aa8716908cb1 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } + if (sec->dofs_offset < sizeof (dof_hdr_t)) { + dtrace_dof_error(dof, "section overlaps header"); + return (-1); + } + + if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff && + sec->dofs_offset < dof->dofh_secoff + + dof->dofh_secnum * dof->dofh_secsize) { + dtrace_dof_error(dof, "invalid section offset"); + return (-1); + } + if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr + sec->dofs_offset + sec->dofs_size - 1) != '\0') { dtrace_dof_error(dof, "non-terminating string table");
