git: 0c829bb55a86 - stable/15 - dtrace: Fix DOF section bounds validation

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=0c829bb55a86b696e6a6c66da28d856cb5c06772

commit 0c829bb55a86b696e6a6c66da28d856cb5c06772
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-06 13:21:08 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-27 17:34:31 +0000

    dtrace: Fix DOF section bounds validation
    
    We must ensure that each DOF section does not overlap with the DOF
    header or section table.  Otherwise the relocations processed in the
    second pass over sections can manipulate DOF metadata, leading to OOB
    writes.
    
    Reviewed by:    christos
    MFC after:      2 weeks
    Sponsored by:   CHERI Research Centre
    Differential Revision:  https://reviews.freebsd.org/D57976
    
    (cherry picked from commit 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15)
---
 sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
index d4c6c5ec449a..aa8716908cb1 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
@@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr,
 			return (-1);
 		}
 
+		if (sec->dofs_offset < sizeof (dof_hdr_t)) {
+			dtrace_dof_error(dof, "section overlaps header");
+			return (-1);
+		}
+
+		if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff &&
+		    sec->dofs_offset < dof->dofh_secoff +
+		    dof->dofh_secnum * dof->dofh_secsize) {
+			dtrace_dof_error(dof, "invalid section offset");
+			return (-1);
+		}
+
 		if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr +
 		    sec->dofs_offset + sec->dofs_size - 1) != '\0') {
 			dtrace_dof_error(dof, "non-terminating string table");