git: bea1c2fcd783 - main - pf: improve ASCONF chunk validation

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=bea1c2fcd7839fd90a8ce96d6dc6a033779bc3c2

commit bea1c2fcd7839fd90a8ce96d6dc6a033779bc3c2
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-04-28 08:54:24 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-04-28 12:00:35 +0000

    pf: improve ASCONF chunk validation
    
    When processing an ASCONF chunk we failed to verify that the chunk
    length was at least 8 bytes. As a result we might end up passing a
    negative length to pf_multihome_scan(). Fortunately this merely meant
    the function did nothing, but we should discard such invalid packets, so
    explicitly check for this.
    
    MFC after:      1 week
    Reported by:    Mark Johnston
    Sponsored by:   Orange Business Services
---
 sys/netpfil/pf/pf.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index dea40816e30f..53f74271e268 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -8462,6 +8462,9 @@ pf_multihome_scan(int start, int len, struct pf_pdesc *pd, int op)
 			    NULL, pd->af))
 				return (PF_DROP);
 
+			if (ntohs(ah.ph.param_length) < sizeof(ah))
+				return (PF_DROP);
+
 			ret = pf_multihome_scan(start + off + sizeof(ah),
 			    ntohs(ah.ph.param_length) - sizeof(ah), pd,
 			    SCTP_ADD_IP_ADDRESS);
@@ -8476,6 +8479,10 @@ pf_multihome_scan(int start, int len, struct pf_pdesc *pd, int op)
 			if (!pf_pull_hdr(pd->m, start + off, &ah, sizeof(ah),
 			    NULL, pd->af))
 				return (PF_DROP);
+
+			if (ntohs(ah.ph.param_length) < sizeof(ah))
+				return (PF_DROP);
+
 			ret = pf_multihome_scan(start + off + sizeof(ah),
 			    ntohs(ah.ph.param_length) - sizeof(ah), pd,
 			    SCTP_DEL_IP_ADDRESS);