Validate total_size in eBPF metadata headers

[Nicholas L (nmlud21)]

Description

ebpf_extension_header_t carries version, size, and total_size. _ebpf_validate_extension_object_header validated only version and size, total_size was never bounded, yet it was used verbatim as both an array stride and a memcpy length into fixed-size stack and pool destinations, an attacker-length, attacker-content kernel out-of-bounds write.

Changes

1. Bound total_size — added _ebpf_extension_type_max_total_size[] (parallel to the existing _supported_ebpf_extension_version[]); the validator now rejects total_size > sizeof(struct). One choke point closes every sink.
2. Validate element 0 before using its total_size as a stride — 6 walkers in ebpf_native.c + 1 in shared_common.c. They previously read the stride from unvalidated memory.
3. Clamp copies to min(total_size, sizeof(dest)) — 5 sites in ebpf_native.c, 1 in shared_common.c; matches the existing _ebpf_copy_program_entry idiom.
4. Collateral OOB read — helper_prototype[i].flags double-indexed an already-offset pointer behind a dead guard (byte count compared to a version constant).

Testing

Ran unit_test passes.

Negative unit test for oversized total_size can be added.

Documentation

No

Installation

No

[github-actions]

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.