git: 43e0c9c1ed40 - stable/15 - ping: do a better job checking what we receive from the net

The branch stable/15 has been updated by maxim:

URL: https://cgit.FreeBSD.org/src/commit/?id=43e0c9c1ed4097173e8277139110af1e43b3c84a

commit 43e0c9c1ed4097173e8277139110af1e43b3c84a
Author:     Maxim Konovalov <maxim@FreeBSD.org>
AuthorDate: 2026-09-16 20:33:18 +0000
Commit:     Maxim Konovalov <maxim@FreeBSD.org>
CommitDate: 2026-10-22 00:09:49 +0000

    ping: do a better job checking what we receive from the net
    
    - zero out a buffer for the incoming icmp message that
      we are about to parse
    - for ICMP_MASKREPLY and ICMP_TSTAMPREPLY responses check their length
      and warn and reject them if they are truncated
    
    Without these checks a part of stack allocated struct icmp icp could
    be printed out which seems low severity since we already dropped root
    privileges by the time icp is allocated.
    
    Reviewed by:    glebius
    MFC after:      1 month
    Found with:     Claude Code Sonnet 5
    
    Differential Revision: https://reviews.freebsd.org/D59555
    
    (cherry picked from commit aa6683207d189a0b58ccf8806bd9f8793914bc45)
---
 sbin/ping/ping.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/sbin/ping/ping.c b/sbin/ping/ping.c
index 3fa21760447f..ebad14c59823 100644
--- a/sbin/ping/ping.c
+++ b/sbin/ping/ping.c
@@ -1112,6 +1112,7 @@ pr_pack(char *buf, ssize_t cc, struct sockaddr_in *from, struct timespec *tv)
 	struct icmp oicmp;
 	const u_char *oicmp_raw;
 
+	bzero(&icp, sizeof(icp));
 	/*
 	 * Get size of IP header of the received packet.
 	 * The header length is contained in the lower four bits of the first
@@ -1151,6 +1152,20 @@ pr_pack(char *buf, ssize_t cc, struct sockaddr_in *from, struct timespec *tv)
 	if (icp.icmp_type == icmp_type_rsp) {
 		if (icp.icmp_id != ident)
 			return;			/* 'Twas not our ECHO */
+		if (icmp_type_rsp == ICMP_MASKREPLY &&
+		    cc < (ssize_t)(ICMP_MINLEN + MASK_LEN)) {
+			if (options & F_VERBOSE)
+				warnx("truncated mask reply (%zd bytes) from %s",
+				    cc, inet_ntoa(from->sin_addr));
+			return;
+		}
+		if (icmp_type_rsp == ICMP_TSTAMPREPLY &&
+		    cc < (ssize_t)(ICMP_MINLEN + TS_LEN)) {
+			if (options & F_VERBOSE)
+				warnx("truncated timestamp reply (%zd bytes) from %s",
+				    cc, inet_ntoa(from->sin_addr));
+			return;
+		}
 		++nreceived;
 		triptime = 0.0;
 		if (timing) {