git: 2349f5a91587 - stable/15 - ipfilter: Fix NULL dereferences in ipf_checkicmp6matchingstate()

The branch stable/15 has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=2349f5a91587eaf00c02ae49b0471cf191bec73a

commit 2349f5a91587eaf00c02ae49b0471cf191bec73a
Author:     Teddy Engel <engel.teddy@gmail.com>
AuthorDate: 2026-05-19 21:36:33 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2026-05-27 13:41:26 +0000

    ipfilter: Fix NULL dereferences in ipf_checkicmp6matchingstate()
    
    Add NULL checks for ic6 (the ICMPv6 header pointer from fin->fin_dp)
    and oic (the inner ICMPv6 header from ofin.fin_dp after ipf_makefrip).
    These pointers can be NULL when processing malformed ICMPv6 error
    packets with extension headers.
    
    Also fix the length validation: the original check (fin->fin_plen <
    sizeof(ip6_t)) could never trigger because an earlier check already
    ensures fin->fin_plen >= ICMP6ERR_MINPKTLEN (48). Replace with a proper
    check that fin->fin_dlen contains at least ICMPERR_ICMPHLEN +
    sizeof(ip6_t) bytes to ensure sufficient data exists for both the
    ICMPv6 error header and the embedded IPv6 header.
    
    PR:             288333
    MFC after:      1 week
    Pull Request:   https://github.com/freebsd/freebsd-src/pull/2214
    Signed-off-by:  Teddy Engel <engel.teddy@gmail.com>
    
    (cherry picked from commit c028080749c09e68c555155df0e9f681ba63c6ae)
---
 sys/netpfil/ipfilter/netinet/ip_state.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/ipfilter/netinet/ip_state.c b/sys/netpfil/ipfilter/netinet/ip_state.c
index 8a21e7593995..774e04b36fd4 100644
--- a/sys/netpfil/ipfilter/netinet/ip_state.c
+++ b/sys/netpfil/ipfilter/netinet/ip_state.c
@@ -4364,9 +4364,13 @@ ipf_checkicmp6matchingstate(fr_info_t *fin)
 	}
 
 	ic6 = fin->fin_dp;
+	if (ic6 == NULL) {
+		SBUMPD(ipf_state_stats, iss_icmp6_miss);
+		return (NULL);
+	}
 
 	oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN);
-	if (fin->fin_plen < sizeof(*oip6)) {
+	if (fin->fin_dlen < ICMPERR_ICMPHLEN + sizeof(*oip6)) {
 		SBUMPD(ipf_state_stats, iss_icmp_short);
 		return (NULL);
 	}
@@ -4408,6 +4412,10 @@ ipf_checkicmp6matchingstate(fr_info_t *fin)
 
 	if (oip6->ip6_nxt == IPPROTO_ICMPV6) {
 		oic = ofin.fin_dp;
+		if (oic == NULL) {
+			SBUMPD(ipf_state_stats, iss_icmp6_miss);
+			return (NULL);
+		}
 		/*
 		 * an ICMP error can only be generated as a result of an
 		 * ICMP query, not as the response on an ICMP error