git: 912c1a2aa8ec - stable/15 - dtrace: Improve DOF section size validation

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=912c1a2aa8ec8fe1ea402446d2105bb4c392b59b

commit 912c1a2aa8ec8fe1ea402446d2105bb4c392b59b
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-06 13:20:33 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-27 17:34:31 +0000

    dtrace: Improve DOF section size validation
    
    The loop which validates each DOF section assumes that the section
    header is present, so the section size must be at least as large as the
    header, otherwise a small OOB access is possible.
    
    Reviewed by:    christos
    MFC after:      2 weeks
    Sponsored by:   CHERI Research Centre
    Differential Revision:  https://reviews.freebsd.org/D57975
    
    (cherry picked from commit c1b6ebc2b7584f93cea4d818468b2aee74475674)
---
 sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
index 853cfb845878..d4c6c5ec449a 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
@@ -14201,8 +14201,8 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr,
 		return (-1);
 	}
 
-	if (dof->dofh_secsize == 0) {
-		dtrace_dof_error(dof, "zero section header size");
+	if (dof->dofh_secsize < sizeof (dof_sec_t)) {
+		dtrace_dof_error(dof, "invalid section header size");
 		return (-1);
 	}