git: 73275ec3d6dc - stable/15 - rtld: more caution when parsing in digest_notes()

The branch stable/15 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=73275ec3d6dc4b110bef3b91b6f2a85f6f88f77e

commit 73275ec3d6dc4b110bef3b91b6f2a85f6f88f77e
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-09-13 10:10:37 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-09-18 11:54:59 +0000

    rtld: more caution when parsing in digest_notes()
    
    (cherry picked from commit fa848d4d0c0371cdbf39265b6528f4c61bc02c7d)
---
 libexec/rtld-elf/rtld.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c
index 93594201fc9e..63bf32c87e3c 100644
--- a/libexec/rtld-elf/rtld.c
+++ b/libexec/rtld-elf/rtld.c
@@ -1779,14 +1779,19 @@ digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path)
 void
 digest_notes(Obj_Entry *obj, Elf_Addr note_start, Elf_Addr note_end)
 {
-	const Elf_Note *note;
+	const Elf_Note *note, *next_note;
 	const char *note_name;
 	uintptr_t p;
 
-	for (note = (const Elf_Note *)note_start; (Elf_Addr)note < note_end;
-	    note = (const Elf_Note *)((const char *)(note + 1) +
-		roundup2(note->n_namesz, sizeof(Elf32_Addr)) +
-		roundup2(note->n_descsz, sizeof(Elf32_Addr)))) {
+	for (note = (const Elf_Note *)note_start;; note = next_note) {
+		if ((Elf_Addr)note + sizeof(Elf_Note) > note_end)
+			break;
+		next_note = (const Elf_Note *)((const char *)(note + 1) +
+		    roundup2(note->n_namesz, sizeof(Elf32_Addr)) +
+		    roundup2(note->n_descsz, sizeof(Elf32_Addr)));
+		if ((Elf_Addr)next_note > note_end)
+			break;
+
 		if (arch_digest_note(obj, note))
 			continue;