git: 6e4ef01c603c - stable/15 - stand: Reject ELF files with PT_LOAD segments where filesz > memsz

The branch stable/15 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=6e4ef01c603c5745922902b42652125720adaa9c

commit 6e4ef01c603c5745922902b42652125720adaa9c
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-07-31 17:52:56 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-10-08 20:42:32 +0000

    stand: Reject ELF files with PT_LOAD segments where filesz > memsz
    
    Reviewed by:    jrtc27, kib
    Differential Revision:  https://reviews.freebsd.org/D58543
    
    (cherry picked from commit c7400fe1df4e971670a7628ddcc856f7a6775dc6)
---
 stand/common/load_elf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/stand/common/load_elf.c b/stand/common/load_elf.c
index 3db513435271..3b78007be816 100644
--- a/stand/common/load_elf.c
+++ b/stand/common/load_elf.c
@@ -635,6 +635,12 @@ __elfN(loadimage)(struct preloaded_file *fp, elf_file_t ef, uint64_t off)
 		if (phdr[i].p_type != PT_LOAD)
 			continue;
 
+		if (phdr[i].p_memsz < phdr[i].p_filesz) {
+			printf("elf" __XSTRING(__ELF_WORD_SIZE)
+			    "_loadimage: invalid PT_LOAD segment\n");
+			goto out;
+		}
+
 		if (module_verbose >= MODULE_VERBOSE_FULL) {
 			printf("Segment: 0x%lx@0x%lx -> 0x%lx-0x%lx",
 			    (long)phdr[i].p_filesz, (long)phdr[i].p_offset,