Page MenuHomeFreeBSD

rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz
ClosedPublic

Authored by jhb on Jul 29 2026, 7:23 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Oct 13, 12:08 AM
Unknown Object (File)
Mon, Oct 12, 1:33 PM
Unknown Object (File)
Mon, Oct 12, 1:28 PM
Unknown Object (File)
Mon, Oct 12, 4:00 AM
Unknown Object (File)
Wed, Oct 7, 2:47 AM
Unknown Object (File)
Thu, Oct 1, 7:56 PM
Unknown Object (File)
Thu, Oct 1, 12:55 PM
Unknown Object (File)
Tue, Sep 29, 1:47 PM
Subscribers

Details

Summary

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front. The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

jhb requested review of this revision.Jul 29 2026, 7:23 PM

I do not object, but I also note that rtld trusts the format of the objects to be correct. There is a lot of missed bounds checks.

This revision is now accepted and ready to land.Jul 30 2026, 4:24 AM

There's also lib/libc/gen/tls.c for PT_TLS

There's also lib/libc/gen/tls.c for PT_TLS

Oof, thanks for catching that, I'll add another commit for that.