The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=c7400fe1df4e971670a7628ddcc856f7a6775dc6
commit c7400fe1df4e971670a7628ddcc856f7a6775dc6 Author: John Baldwin <[email protected]> AuthorDate: 2026-07-31 17:52:56 +0000 Commit: John Baldwin <[email protected]> CommitDate: 2026-07-31 17:52:56 +0000 stand: Reject ELF files with PT_LOAD segments where filesz > memsz Reviewed by: jrtc27, kib Differential Revision: https://reviews.freebsd.org/D58543 --- stand/common/load_elf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/stand/common/load_elf.c b/stand/common/load_elf.c index 14fc0893f088..d0cdf425f0f0 100644 --- a/stand/common/load_elf.c +++ b/stand/common/load_elf.c @@ -636,6 +636,12 @@ __elfN(loadimage)(struct preloaded_file *fp, elf_file_t ef, uint64_t off) if (phdr[i].p_type != PT_LOAD) continue; + if (phdr[i].p_memsz < phdr[i].p_filesz) { + printf("elf" __XSTRING(__ELF_WORD_SIZE) + "_loadimage: invalid PT_LOAD segment\n"); + goto out; + } + if (module_verbose >= MODULE_VERBOSE_FULL) { printf("Segment: 0x%lx@0x%lx -> 0x%lx-0x%lx", (long)phdr[i].p_filesz, (long)phdr[i].p_offset,
