diff options
| author | Jerry Jelinek <jerry.jelinek@joyent.com> | 2017-11-30 16:14:49 -0500 |
|---|---|---|
| committer | Dan McDonald <danmcd@joyent.com> | 2017-11-30 16:14:53 -0500 |
| commit | 2cf374268f3e1c9e9be6367466b183d27632583a (patch) | |
| tree | f18d5cc73b254bc9e11c20cab68d83ce89c37218 /usr/src/uts/common/dtrace/dtrace.c | |
| parent | dfbc6f2daa6bb8fc06fad985ead27d5db30eab3a (diff) | |
| download | illumos-joyent-2cf374268f3e1c9e9be6367466b183d27632583a.tar.gz | |
8880 improve DTrace error checking
Reviewed by: Tim Kordas <tim.kordas@joyent.com>
Reviewed by: Bryan Cantrill <bryan@joyent.com>
Reviewed by: Richard Lowe <richlowe@richlowe.net>
Approved by: Dan McDonald <danmcd@joyent.com>
Diffstat (limited to 'usr/src/uts/common/dtrace/dtrace.c')
| -rw-r--r-- | usr/src/uts/common/dtrace/dtrace.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/usr/src/uts/common/dtrace/dtrace.c b/usr/src/uts/common/dtrace/dtrace.c index 28ad7ec09b..ced7249084 100644 --- a/usr/src/uts/common/dtrace/dtrace.c +++ b/usr/src/uts/common/dtrace/dtrace.c @@ -13127,6 +13127,7 @@ static int dtrace_dof_relocate(dof_hdr_t *dof, dof_sec_t *sec, uint64_t ubase) { uintptr_t daddr = (uintptr_t)dof; + uintptr_t ts_end; dof_relohdr_t *dofr = (dof_relohdr_t *)(uintptr_t)(daddr + sec->dofs_offset); dof_sec_t *ss, *rs, *ts; @@ -13142,6 +13143,7 @@ dtrace_dof_relocate(dof_hdr_t *dof, dof_sec_t *sec, uint64_t ubase) ss = dtrace_dof_sect(dof, DOF_SECT_STRTAB, dofr->dofr_strtab); rs = dtrace_dof_sect(dof, DOF_SECT_RELTAB, dofr->dofr_relsec); ts = dtrace_dof_sect(dof, DOF_SECT_NONE, dofr->dofr_tgtsec); + ts_end = (uintptr_t)ts + sizeof (dof_sec_t); if (ss == NULL || rs == NULL || ts == NULL) return (-1); /* dtrace_dof_error() has been called already */ @@ -13168,6 +13170,11 @@ dtrace_dof_relocate(dof_hdr_t *dof, dof_sec_t *sec, uint64_t ubase) return (-1); } + if (taddr >= (uintptr_t)ts && taddr < ts_end) { + dtrace_dof_error(dof, "bad relocation offset"); + return (-1); + } + if (!IS_P2ALIGNED(taddr, sizeof (uint64_t))) { dtrace_dof_error(dof, "misaligned setx relo"); return (-1); |