git: c028080749c0 - main - ipfilter: Fix NULL dereferences in ipf_checkicmp6matchingstate()

The branch main has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=c028080749c09e68c555155df0e9f681ba63c6ae

commit c028080749c09e68c555155df0e9f681ba63c6ae
Author:     Teddy Engel <engel.teddy@gmail.com>
AuthorDate: 2026-05-19 21:36:33 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2026-05-20 15:33:43 +0000

    ipfilter: Fix NULL dereferences in ipf_checkicmp6matchingstate()
    
    Add NULL checks for ic6 (the ICMPv6 header pointer from fin->fin_dp)
    and oic (the inner ICMPv6 header from ofin.fin_dp after ipf_makefrip).
    These pointers can be NULL when processing malformed ICMPv6 error
    packets with extension headers.
    
    Also fix the length validation: the original check (fin->fin_plen <
    sizeof(ip6_t)) could never trigger because an earlier check already
    ensures fin->fin_plen >= ICMP6ERR_MINPKTLEN (48). Replace with a proper
    check that fin->fin_dlen contains at least ICMPERR_ICMPHLEN +
    sizeof(ip6_t) bytes to ensure sufficient data exists for both the
    ICMPv6 error header and the embedded IPv6 header.
    
    PR:             288333
    MFC after:      1 week
    Pull Request:   https://github.com/freebsd/freebsd-src/pull/2214
    Signed-off-by:  Teddy Engel <engel.teddy@gmail.com>
---
 sys/netpfil/ipfilter/netinet/ip_state.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/ipfilter/netinet/ip_state.c b/sys/netpfil/ipfilter/netinet/ip_state.c
index c8d6e4e0feb3..d5a04e326321 100644
--- a/sys/netpfil/ipfilter/netinet/ip_state.c
+++ b/sys/netpfil/ipfilter/netinet/ip_state.c
@@ -4364,9 +4364,13 @@ ipf_checkicmp6matchingstate(fr_info_t *fin)
 	}
 
 	ic6 = fin->fin_dp;
+	if (ic6 == NULL) {
+		SBUMPD(ipf_state_stats, iss_icmp6_miss);
+		return (NULL);
+	}
 
 	oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN);
-	if (fin->fin_plen < sizeof(*oip6)) {
+	if (fin->fin_dlen < ICMPERR_ICMPHLEN + sizeof(*oip6)) {
 		SBUMPD(ipf_state_stats, iss_icmp_short);
 		return (NULL);
 	}
@@ -4408,6 +4412,10 @@ ipf_checkicmp6matchingstate(fr_info_t *fin)
 
 	if (oip6->ip6_nxt == IPPROTO_ICMPV6) {
 		oic = ofin.fin_dp;
+		if (oic == NULL) {
+			SBUMPD(ipf_state_stats, iss_icmp6_miss);
+			return (NULL);
+		}
 		/*
 		 * an ICMP error can only be generated as a result of an
 		 * ICMP query, not as the response on an ICMP error