git: a8954ff89caa - stable/14 - dtrace: Fix DOF section bounds validation

The branch stable/14 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=a8954ff89caa6be06361959cdcbc561d615e0e73

commit a8954ff89caa6be06361959cdcbc561d615e0e73
Author:     Mark Johnston <[email protected]>
AuthorDate: 2026-07-06 13:21:08 +0000
Commit:     Mark Johnston <[email protected]>
CommitDate: 2026-07-27 14:05:07 +0000

    dtrace: Fix DOF section bounds validation
    
    We must ensure that each DOF section does not overlap with the DOF
    header or section table.  Otherwise the relocations processed in the
    second pass over sections can manipulate DOF metadata, leading to OOB
    writes.
    
    Reviewed by:    christos
    MFC after:      2 weeks
    Sponsored by:   CHERI Research Centre
    Differential Revision:  https://reviews.freebsd.org/D57976
    
    (cherry picked from commit 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15)
---
 sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
index d4c6c5ec449a..aa8716908cb1 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
@@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr,
 			return (-1);
 		}
 
+		if (sec->dofs_offset < sizeof (dof_hdr_t)) {
+			dtrace_dof_error(dof, "section overlaps header");
+			return (-1);
+		}
+
+		if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff &&
+		    sec->dofs_offset < dof->dofh_secoff +
+		    dof->dofh_secnum * dof->dofh_secsize) {
+			dtrace_dof_error(dof, "invalid section offset");
+			return (-1);
+		}
+
 		if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr +
 		    sec->dofs_offset + sec->dofs_size - 1) != '\0') {
 			dtrace_dof_error(dof, "non-terminating string table");