Change Details

icmp_error allocates either an mbuf w/ pkthdr or a cluster depending on the size of data to be quoted, but the calculation failed to account for additional padding that may be added by m_align. Repeat the alignment logic inline where the mbuf / cluster decision is made as an immediate fix for the buffer underwrite. This will be revisited shortly. Also add an assertion that we will not move m_data before the beginning of the mbuf or cluster. Report in https://www.reddit.com/r/BSD/comments/9v6xwg/remotely_triggerable_icmp_buffer_underwrite_in/ Reported by: a reddit user

icmp_error allocates either an mbuf w/ pkthdr or a cluster depending on the size of data to be quoted, but the calculation failed to account for additional padding that may be added by m_align. Include the ip header in the size passed to m_align. On 64-bit archs this will have the net effect of moving everything 4 bytes later in the mbuf or cluster and will result in slightly pessimal alignment for the icmp data copy. Also add an assertion that we will not move m_data before the beginning of the mbuf or cluster. Report in https://www.reddit.com/r/BSD/comments/9v6xwg/remotely_triggerable_icmp_buffer_underwrite_in/ Reported by: a reddit user

icmp_error allocates either an mbuf w/ pkthdr or a cluster depending on the size of data to be quoted, but the calculation failed to account for additional padding that may be added by m_align. Repeat the alignment logic inline wherInclude the mbuf / cluster decision is made as an immediate fix for the buffer underwriteip header in the size passed to m_align. This will be revisited shortlOn 64-bit archs this will have the net effect of moving everything 4 bytes later in the mbuf or cluster and will result in slightly pessimal alignment for the icmp data copy. Also add an assertion that we will not move m_data before the beginning of the mbuf or cluster. Report in https://www.reddit.com/r/BSD/comments/9v6xwg/remotely_triggerable_icmp_buffer_underwrite_in/ Reported by: a reddit user