git: a3174f0f4721 - stable/14 - libc: Reject static ELF exectables with PT_TLS segments were filesz > memsz

From: John Baldwin <jhb_at_FreeBSD.org>
Date: Fri, 09 Oct 2026 00:20:48 UTC
The branch stable/14 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=a3174f0f4721ab09d69d5e676b778b418fed68ad

commit a3174f0f4721ab09d69d5e676b778b418fed68ad
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-07-31 17:52:34 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-10-08 18:47:31 +0000

    libc: Reject static ELF exectables with PT_TLS segments were filesz > memsz
    
    Reviewed by:    jrtc27
    Differential Revision:  https://reviews.freebsd.org/D58558
    
    (cherry picked from commit b9eaf9b7cef25228e8c20e3819f1b7be94f486aa)
---
 lib/libc/gen/tls.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/libc/gen/tls.c b/lib/libc/gen/tls.c
index 8d453eccb801..86078e2a2fb8 100644
--- a/lib/libc/gen/tls.c
+++ b/lib/libc/gen/tls.c
@@ -436,6 +436,10 @@ _init_tls(void)
 
 	for (i = 0; (unsigned) i < phnum; i++) {
 		if (phdr[i].p_type == PT_TLS) {
+			if (phdr[i].p_memsz < phdr[i].p_filesz) {
+				tls_msg("_init_tls: invalid PT_TLS segment.\n");
+				abort();
+			}
 			libc_tls_static_space = roundup2(phdr[i].p_memsz,
 			    phdr[i].p_align);
 			libc_tls_init_size = phdr[i].p_filesz;