rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz
ClosedPublic
Actions

Authored by jhb on Jul 29 2026, 7:23 PM.

Details

Reviewers

kib
markj
jrtc27

Commits

rG535eb24d8451: rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz

Summary

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front. The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

jhb created this revision.Jul 29 2026, 7:23 PM

Herald added subscribers: bdragon, imp. · View Herald TranscriptJul 29 2026, 7:23 PM

jhb requested review of this revision.Jul 29 2026, 7:23 PM

Harbormaster completed remote builds in B75276: Diff 183070.Jul 29 2026, 7:23 PM

jhb added a parent revision: D58540: stand: Improve error handling when loading ELF files.Jul 29 2026, 7:23 PM

jhb added a child revision: D58542: kld: Reject kernel modules with PT_LOAD segments where filesz > memsz.

I do not object, but I also note that rtld trusts the format of the objects to be correct. There is a lot of missed bounds checks.

This revision is now accepted and ready to land.Jul 30 2026, 4:24 AM

There's also lib/libc/gen/tls.c for PT_TLS

In D58541#1343668, @jrtc27 wrote:

There's also lib/libc/gen/tls.c for PT_TLS

Oof, thanks for catching that, I'll add another commit for that.

Closed by commit rG535eb24d8451: rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz (authored by jhb). · Explain WhyJul 31 2026, 5:58 PM

This revision was automatically updated to reflect the committed changes.

jhb added a commit: rG535eb24d8451: rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz.

Revision Contents
Changeset List

Path

Size

libexec/

rtld-elf/

map_object.c

12 lines

rtld.c

6 lines

Diff 183175

View Options

libexec/rtld-elf/map_object.c