git: 8dc98f4d25a3 - main - dtrace: Fix DOF section bounds validation

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15

commit 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-06 13:21:08 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-06 13:21:08 +0000

    dtrace: Fix DOF section bounds validation
    
    We must ensure that each DOF section does not overlap with the DOF
    header or section table.  Otherwise the relocations processed in the
    second pass over sections can manipulate DOF metadata, leading to OOB
    writes.
    
    Reviewed by:    christos
    MFC after:      2 weeks
    Sponsored by:   CHERI Research Centre
    Differential Revision:  https://reviews.freebsd.org/D57976
---
 sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
index d4c6c5ec449a..aa8716908cb1 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
@@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr,
 			return (-1);
 		}
 
+		if (sec->dofs_offset < sizeof (dof_hdr_t)) {
+			dtrace_dof_error(dof, "section overlaps header");
+			return (-1);
+		}
+
+		if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff &&
+		    sec->dofs_offset < dof->dofh_secoff +
+		    dof->dofh_secnum * dof->dofh_secsize) {
+			dtrace_dof_error(dof, "invalid section offset");
+			return (-1);
+		}
+
 		if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr +
 		    sec->dofs_offset + sec->dofs_size - 1) != '\0') {
 			dtrace_dof_error(dof, "non-terminating string table");