Module Name: src Committed By: knakahara Date: Fri Jul 7 00:55:16 UTC 2017
Modified Files: src/sys/netinet6: icmp6.c Log Message: fix PR kern/52353. implemented by ozaki-r@n.o. I just commit by proxy. XXX need to pullup to -8. To generate a diff of this commit: cvs rdiff -u -r1.211 -r1.212 src/sys/netinet6/icmp6.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/netinet6/icmp6.c diff -u src/sys/netinet6/icmp6.c:1.211 src/sys/netinet6/icmp6.c:1.212 --- src/sys/netinet6/icmp6.c:1.211 Tue Mar 14 04:24:04 2017 +++ src/sys/netinet6/icmp6.c Fri Jul 7 00:55:15 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: icmp6.c,v 1.211 2017/03/14 04:24:04 ozaki-r Exp $ */ +/* $NetBSD: icmp6.c,v 1.212 2017/07/07 00:55:15 knakahara Exp $ */ /* $KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $ */ /* @@ -62,7 +62,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.211 2017/03/14 04:24:04 ozaki-r Exp $"); +__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.212 2017/07/07 00:55:15 knakahara Exp $"); #ifdef _KERNEL_OPT #include "opt_inet.h" @@ -494,6 +494,15 @@ _icmp6_input(struct mbuf *m, int off, in goto freeit; } + if (m->m_len < sizeof(struct ip6_hdr)) { + m = m_pullup(m, sizeof(struct ip6_hdr)); + if (m == NULL) { + ICMP6_STATINC(ICMP6_STAT_TOOSHORT); + icmp6_ifstat_inc(rcvif, ifs6_in_error); + goto freeit; + } + } + ip6 = mtod(m, struct ip6_hdr *); IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6)); if (icmp6 == NULL) {