[src/netbsd-7-0]: src/sys/netinet6 Pull up following revision(s) (requested b...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/860735737fd4
branches:  netbsd-7-0
changeset: 801502:860735737fd4
user:      martin <martin%NetBSD.org@localhost>
date:      Tue Aug 14 14:36:37 2018 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #1630):

        sys/netinet6/frag6.c: revision 1.64

Kick zero-sized fragments. We can't allow them to enter; two fragments
could be put at the same offset.

diffstat:

 sys/netinet6/frag6.c |  9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diffs (35 lines):

diff -r 5c4b329ef1df -r 860735737fd4 sys/netinet6/frag6.c
--- a/sys/netinet6/frag6.c      Thu Jul 12 14:59:58 2018 +0000
+++ b/sys/netinet6/frag6.c      Tue Aug 14 14:36:37 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: frag6.c,v 1.55.6.2 2018/04/05 11:53:02 martin Exp $    */
+/*     $NetBSD: frag6.c,v 1.55.6.3 2018/08/14 14:36:37 martin Exp $    */
 /*     $KAME: frag6.c,v 1.40 2002/05/27 21:40:31 itojun Exp $  */
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: frag6.c,v 1.55.6.2 2018/04/05 11:53:02 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: frag6.c,v 1.55.6.3 2018/08/14 14:36:37 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -152,13 +152,14 @@
        }
 
        /*
-        * check whether fragment packet's fragment length is
+        * Check whether fragment packet's fragment length is non-zero and
         * multiple of 8 octets.
         * sizeof(struct ip6_frag) == 8
         * sizeof(struct ip6_hdr) = 40
         */
        if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) &&
-           (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
+           (((ntohs(ip6->ip6_plen) - offset) == 0) ||
+            ((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
                icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
                    offsetof(struct ip6_hdr, ip6_plen));
                in6_ifstat_inc(dstifp, ifs6_reass_fail);