Page MenuHomeFreeBSD
Differential D57811

link_elf: Uncapped dynamic-section walk (parse_dynamic)
Needs ReviewPublic
Actions

Authored by thebugfixers_pm.me on Jun 24 2026, 9:41 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Aug 2, 5:10 AM
Unknown Object (File)
Sat, Aug 1, 6:16 AM
Unknown Object (File)
Mon, Jul 27, 12:02 AM
Unknown Object (File)
Sun, Jul 26, 4:29 AM
Unknown Object (File)
Sat, Jul 25, 7:25 PM
Unknown Object (File)
Fri, Jul 24, 5:43 PM
Unknown Object (File)
Thu, Jul 16, 6:25 AM
Unknown Object (File)
Tue, Jul 14, 3:12 PM
View All 16 Files
Subscribers
imp
olce

Details

Reviewers
None
Group Reviewers
Src Committers
Contributor Reviews (src)
Summary

There is no limit on how far this loop advances. If the PT_DYNAMIC segment is malformed and lacks a DT_NULL terminator within its bounds, the kernel scans forward indefinitely.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Revision Contents
Changeset List

PathSize
sys/
kern/
5 lines

Diff 180515

View Options

sys/kern/link_elf.c

Loading...