From nobody Mon Sep 21 09:02:18 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hpHL241tXz6rHfb for ; Mon, 21 Sep 2026 09:02:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hpHL23FXZz4nlx for ; Mon, 21 Sep 2026 09:02:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789981338; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bPOSMzHJKmk9KV3RJwMP0Lo5f21q8a3fwHw975AMqzw=; b=BnVCQRjdFiiJRYVSjCHUphsSBphDshFWhbE/4LpMfe7bs6v7qndE7RCRmp4fhfGPsGv1dt uc2w5/2o40ptvbLka2uxGK/AuCBQY3OkArvR02/wknW0WhyUA40EPw4pZUmDHXnx3eTWf1 RHu3Jx8/oB5PXISGEmOAfp+6RMhQ0jDqkkcnDaZSbWW7kHUCD0zZCLD4Hi/lqbKVPEZ2wE O1bLZp06UJq6D3HygWjtl0KtDT6Sce5riQzG79NvLUH1pP3v7UYyDXkNqpO+3ljUQ6KJOy 4AK54eJXOTFqm+6qK+9Iw37Y0HvoRJsJnL8WcmHoJuJaoM5mmB86EYrxS1e68w== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789981338; b=Cs88lf1ZSWzR8j0JkWs3+dprL23vGPAXoKIpMwR7gvJSKkYVHk/7qlWhiB5S5FRNqdAL8U QmUlyS/MZ56qG+3IrDiflXRdzZmxRirbGmbAW2RVy/KF075snbZaa2YxPDBhg6SOsngMlk ujhEYBaYu2QJFE+UthvX38cMpfXQbaHIU9agmDszndW9XpQYyI1QnKXCyvLRoo33YQIAPD MKMQGB0VBNHUWWiFkQt0ENvdlsAHZBXEt/yjFvD2kFRz/TSyIOcO+YltPlLP8DgM25Pg4k HY8qm1eT+xGVBCMJSav21KbfpBDTCI/FN2gd6YXCsd54QdeXTnIDfJEekwNiZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789981338; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bPOSMzHJKmk9KV3RJwMP0Lo5f21q8a3fwHw975AMqzw=; b=mXwj35WW7iMYqRyYMwEw8t+i3b6KFRrArN/YMDk7cxCuwCMkt8BFnDVll+O1l/R2RrPT8X FNdpX8805nwXIMu8XhN7JkCH0qxmSgZ/3cVP5Zzc8y1xUJfuelrAi14rVe4z6rdLlF29Xf fxEn1Yu/nirLI6WZ2iltAAxv5GKCXOYb4see/yex//JsQafHWRgD0y+XD87UGsnDjPNQkL f/mvlxuXQfUTCrOszrCAxDX0AQMdepE61Y9cAPqrzglNBfObsyyaRh7uymL0eiy6DMUbkR gHrU95rC4l+OQTGJwLSWrAdlOLUSPQxYdpHsyocOD/FCim1QlIvneW6tBX3apg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hpHL22JrNz1Cws for ; Mon, 21 Sep 2026 09:02:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2081e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 21 Sep 2026 09:02:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: 2cfb88e5d559 - stable/14 - rtld: more caution when parsing in digest_notes() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 2cfb88e5d559aeee9b1d2aa005d5f9998adfe790 Auto-Submitted: auto-generated Date: Mon, 21 Sep 2026 09:02:18 +0000 Message-Id: <6ab0f29a.2081e.1119aa5f@gitrepo.freebsd.org> The branch stable/14 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=2cfb88e5d559aeee9b1d2aa005d5f9998adfe790 commit 2cfb88e5d559aeee9b1d2aa005d5f9998adfe790 Author: Konstantin Belousov AuthorDate: 2026-09-13 10:10:37 +0000 Commit: Konstantin Belousov CommitDate: 2026-09-21 09:02:11 +0000 rtld: more caution when parsing in digest_notes() (cherry picked from commit fa848d4d0c0371cdbf39265b6528f4c61bc02c7d) --- libexec/rtld-elf/rtld.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c index 44f895339a32..29fad4302528 100644 --- a/libexec/rtld-elf/rtld.c +++ b/libexec/rtld-elf/rtld.c @@ -1724,14 +1724,19 @@ digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path) void digest_notes(Obj_Entry *obj, Elf_Addr note_start, Elf_Addr note_end) { - const Elf_Note *note; + const Elf_Note *note, *next_note; const char *note_name; uintptr_t p; - for (note = (const Elf_Note *)note_start; (Elf_Addr)note < note_end; - note = (const Elf_Note *)((const char *)(note + 1) + - roundup2(note->n_namesz, sizeof(Elf32_Addr)) + - roundup2(note->n_descsz, sizeof(Elf32_Addr)))) { + for (note = (const Elf_Note *)note_start;; note = next_note) { + if ((Elf_Addr)note + sizeof(Elf_Note) > note_end) + break; + next_note = (const Elf_Note *)((const char *)(note + 1) + + roundup2(note->n_namesz, sizeof(Elf32_Addr)) + + roundup2(note->n_descsz, sizeof(Elf32_Addr))); + if ((Elf_Addr)next_note > note_end) + break; + if (note->n_namesz != sizeof(NOTE_FREEBSD_VENDOR) || note->n_descsz != sizeof(int32_t)) continue;