git: a337053ca5dd - stable/14 - stand: Reject ELF files with PT_LOAD segments where filesz > memsz

The branch stable/14 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=a337053ca5ddcea570f0aebd0b17680b50cc96db

commit a337053ca5ddcea570f0aebd0b17680b50cc96db
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-07-31 17:52:56 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-10-08 18:47:52 +0000

    stand: Reject ELF files with PT_LOAD segments where filesz > memsz
    
    Reviewed by:    jrtc27, kib
    Differential Revision:  https://reviews.freebsd.org/D58543
    
    (cherry picked from commit c7400fe1df4e971670a7628ddcc856f7a6775dc6)
---
 stand/common/load_elf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/stand/common/load_elf.c b/stand/common/load_elf.c
index 6d4cc5335bda..bd02bc2e30ef 100644
--- a/stand/common/load_elf.c
+++ b/stand/common/load_elf.c
@@ -642,6 +642,12 @@ __elfN(loadimage)(struct preloaded_file *fp, elf_file_t ef, uint64_t off)
 		if (phdr[i].p_type != PT_LOAD)
 			continue;
 
+		if (phdr[i].p_memsz < phdr[i].p_filesz) {
+			printf("elf" __XSTRING(__ELF_WORD_SIZE)
+			    "_loadimage: invalid PT_LOAD segment\n");
+			goto out;
+		}
+
 		if (module_verbose >= MODULE_VERBOSE_FULL) {
 			printf("Segment: 0x%lx@0x%lx -> 0x%lx-0x%lx",
 			    (long)phdr[i].p_filesz, (long)phdr[i].p_offset,