diff options
| author | Teddy Engel <engel.teddy@gmail.com> | 2026-05-19 21:36:23 +0000 |
|---|---|---|
| committer | Cy Schubert <cy@FreeBSD.org> | 2026-05-20 15:33:43 +0000 |
| commit | cdc40489a7a617b742e295cf9005b3569b45e823 (patch) | |
| tree | b6cfd20d713510dcab87a9b264104648ad96da52 | |
| parent | 68ed81631afa20c07883f7f60343f6da8397ee41 (diff) | |
ipfilter: Add NULL check for fin_m in ipf_pr_icmp6()
Add NULL check for fin->fin_m before calling M_LEN() in the ICMPv6
error handling code path. When ipf_checkicmp6matchingstate() calls
ipf_makefrip() with a synthesized fr_info_t that has fin_m set to
NULL, the subsequent call to ipf_pr_ipv6hdr() can reach ipf_pr_icmp6()
which would crash when trying to access the mbuf via M_LEN().
PR: 288333
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2214
Signed-off-by: Teddy Engel <engel.teddy@gmail.com>
| -rw-r--r-- | sys/netpfil/ipfilter/netinet/fil.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c index 4174fdcc5f58..7b646d0d55db 100644 --- a/sys/netpfil/ipfilter/netinet/fil.c +++ b/sys/netpfil/ipfilter/netinet/fil.c @@ -916,6 +916,9 @@ ipf_pr_icmp6(fr_info_t *fin) if (fin->fin_plen < ICMP6ERR_IPICMPHLEN) break; + if (fin->fin_m == NULL) + break; + if (M_LEN(fin->fin_m) < fin->fin_plen) { if (ipf_coalesce(fin) != 1) return; |