svn commit: r340313 - head/sys/netinet

[Mark Johnston]

Author: markj
Date: Sat Nov 10 03:00:36 2018
New Revision: 340313
URL: https://svnweb.freebsd.org/changeset/base/340313

Log:
  Ensure that IP fragments do not extend beyond IP_MAXPACKET.
  
  Such fragments are obviously invalid, and when processed may end up
  violating the sort order (by offset) of fragments of a given packet.
  This doesn't appear to be exploitable, however.
  
  Reviewed by:	emaste
  Discussed with:	jtl
  MFC after:	3 days
  Sponsored by:	The FreeBSD Foundation
  Differential Revision:	https://reviews.freebsd.org/D17914

Modified:
  head/sys/netinet/ip_reass.c

Modified: head/sys/netinet/ip_reass.c
==============================================================================
--- head/sys/netinet/ip_reass.c	Sat Nov 10 02:37:56 2018	(r340312)
+++ head/sys/netinet/ip_reass.c	Sat Nov 10 03:00:36 2018	(r340313)
@@ -228,6 +228,16 @@ ip_reass(struct mbuf *m)
 	ip->ip_off = htons(ntohs(ip->ip_off) << 3);
 
 	/*
+	 * Make sure the fragment lies within a packet of valid size.
+	 */
+	if (ntohs(ip->ip_len) + ntohs(ip->ip_off) > IP_MAXPACKET) {
+		IPSTAT_INC(ips_toolong);
+		IPSTAT_INC(ips_fragdropped);
+		m_freem(m);
+		return (NULL);
+	}
+
+	/*
 	 * Attempt reassembly; if it succeeds, proceed.
 	 * ip_reass() will return a different mbuf.
 	 */