[src/netbsd-8]: src/sys/netinet Pull up following revision(s) (requested by m...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9325694f297f
branches:  netbsd-8
changeset: 434800:9325694f297f
user:      martin <martin%NetBSD.org@localhost>
date:      Sat Mar 31 10:38:53 2018 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #675):

        sys/netinet/ip_icmp.c: revision 1.168

Fix a possible buffer overflow in the IPv4 _ctlinput functions.

In _icmp_input we are guaranteeing that the ICMP_ADVLENMIN-byte area
starting from 'icp' is contiguous.

        ICMP_ADVLENMIN = 8 + sizeof(struct ip) + 8 = 36

But the _ctlinput functions (eg udp_ctlinput) expect the area to be
larger. These functions read at:

        (uint8_t *)icp + 8 + (icp->icmp_ip.ip_hl << 2)

which can be crafted to be:

        (uint8_t *)icp + 68

So we end up reading 'icp+68' while the valid area ended at 'icp+36'.

Having said that, it seems pretty complicated to trigger this bug; it
would have to be a fragmented packet with half of the ICMP header in the
first fragment, and we would need to have a driver that did not allocate
a cluster for the first mbuf of the chain.

The check of icmplen against ICMP_ADVLEN(icp) was not sufficient: while it
did guarantee that the ICMP header fit the chain, it did not guarantee
that it fit 'm'.

Fix this bug by pulling up to hlen+ICMP_ADVLEN(icp). No need to log an
error. Rebase the pointers afterwards.

diffstat:

 sys/netinet/ip_icmp.c |  12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diffs (33 lines):

diff -r 38e9bb1509df -r 9325694f297f sys/netinet/ip_icmp.c
--- a/sys/netinet/ip_icmp.c     Sat Mar 31 10:32:05 2018 +0000
+++ b/sys/netinet/ip_icmp.c     Sat Mar 31 10:38:53 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip_icmp.c,v 1.161 2017/03/31 06:49:44 ozaki-r Exp $    */
+/*     $NetBSD: ip_icmp.c,v 1.161.6.1 2018/03/31 10:38:53 martin Exp $ */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -94,7 +94,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.161 2017/03/31 06:49:44 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.161.6.1 2018/03/31 10:38:53 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ipsec.h"
@@ -541,6 +541,14 @@
                        ICMP_STATINC(ICMP_STAT_BADLEN);
                        goto freeit;
                }
+               if (m->m_len < hlen + ICMP_ADVLEN(icp)) {
+                       m = m_pullup(m, hlen + ICMP_ADVLEN(icp));
+                       if (m == NULL)
+                               goto freeit;
+               }
+               ip = mtod(m, struct ip *);
+               icp = (struct icmp *)(mtod(m, uint8_t *) + hlen);
+
                if (IN_MULTICAST(icp->icmp_ip.ip_dst.s_addr))
                        goto badcode;
 #ifdef ICMPPRINTFS