[src/trunk]: src/sys/netinet6 fix PR kern/52353. implemented by ozaki-r@n.o. ...

[knakahara <knakahara%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8ecfd0294656
branches:  trunk
changeset: 354981:8ecfd0294656
user:      knakahara <knakahara%NetBSD.org@localhost>
date:      Fri Jul 07 00:55:15 2017 +0000

description:
fix PR kern/52353. implemented by ozaki-r@n.o. I just commit by proxy.

XXX need to pullup to -8.

diffstat:

 sys/netinet6/icmp6.c |  13 +++++++++++--
 1 files changed, 11 insertions(+), 2 deletions(-)

diffs (34 lines):

diff -r f681fb54a688 -r 8ecfd0294656 sys/netinet6/icmp6.c
--- a/sys/netinet6/icmp6.c      Fri Jul 07 00:34:09 2017 +0000
+++ b/sys/netinet6/icmp6.c      Fri Jul 07 00:55:15 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: icmp6.c,v 1.211 2017/03/14 04:24:04 ozaki-r Exp $      */
+/*     $NetBSD: icmp6.c,v 1.212 2017/07/07 00:55:15 knakahara Exp $    */
 /*     $KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $ */
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.211 2017/03/14 04:24:04 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.212 2017/07/07 00:55:15 knakahara Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -494,6 +494,15 @@
                goto freeit;
        }
 
+       if (m->m_len < sizeof(struct ip6_hdr)) {
+               m = m_pullup(m, sizeof(struct ip6_hdr));
+               if (m == NULL) {
+                       ICMP6_STATINC(ICMP6_STAT_TOOSHORT);
+                       icmp6_ifstat_inc(rcvif, ifs6_in_error);
+                       goto freeit;
+               }
+       }
+
        ip6 = mtod(m, struct ip6_hdr *);
        IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6));
        if (icmp6 == NULL) {