git: 2cfb88e5d559 - stable/14 - rtld: more caution when parsing in digest_notes()

The branch stable/14 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=2cfb88e5d559aeee9b1d2aa005d5f9998adfe790

commit 2cfb88e5d559aeee9b1d2aa005d5f9998adfe790
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-09-13 10:10:37 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-09-21 09:02:11 +0000

    rtld: more caution when parsing in digest_notes()
    
    (cherry picked from commit fa848d4d0c0371cdbf39265b6528f4c61bc02c7d)
---
 libexec/rtld-elf/rtld.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c
index 44f895339a32..29fad4302528 100644
--- a/libexec/rtld-elf/rtld.c
+++ b/libexec/rtld-elf/rtld.c
@@ -1724,14 +1724,19 @@ digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path)
 void
 digest_notes(Obj_Entry *obj, Elf_Addr note_start, Elf_Addr note_end)
 {
-	const Elf_Note *note;
+	const Elf_Note *note, *next_note;
 	const char *note_name;
 	uintptr_t p;
 
-	for (note = (const Elf_Note *)note_start; (Elf_Addr)note < note_end;
-	    note = (const Elf_Note *)((const char *)(note + 1) +
-	      roundup2(note->n_namesz, sizeof(Elf32_Addr)) +
-	      roundup2(note->n_descsz, sizeof(Elf32_Addr)))) {
+	for (note = (const Elf_Note *)note_start;; note = next_note) {
+		if ((Elf_Addr)note + sizeof(Elf_Note) > note_end)
+			break;
+		next_note = (const Elf_Note *)((const char *)(note + 1) +
+		    roundup2(note->n_namesz, sizeof(Elf32_Addr)) +
+		    roundup2(note->n_descsz, sizeof(Elf32_Addr)));
+		if ((Elf_Addr)next_note > note_end)
+			break;
+
 		if (note->n_namesz != sizeof(NOTE_FREEBSD_VENDOR) ||
 		    note->n_descsz != sizeof(int32_t))
 			continue;