icmp: add missing attribute length check

Fixes golang/go#10951.

Change-Id: I94bf948ce74f8289008930701b2825ffcf57fce1
Reviewed-on: https://go-review.googlesource.com/10378
Reviewed-by: Ian Lance Taylor <iant@golang.org>

icmp/extension_test.go

@@ -238,3 +238,22 @@ func TestMarshalAndParseExtension(t *testing.T) {
 		}
 	}
 }
+
+var parseInterfaceNameTests = []struct {
+	b []byte
+	error
+}{
+	{[]byte{0, 'e', 'n', '0'}, errInvalidExtension},
+	{[]byte{4, 'e', 'n', '0'}, nil},
+	{[]byte{7, 'e', 'n', '0', 0xff, 0xff, 0xff, 0xff}, errInvalidExtension},
+	{[]byte{8, 'e', 'n', '0', 0xff, 0xff, 0xff}, errMessageTooShort},
+}
+
+func TestParseInterfaceName(t *testing.T) {
+	ifi := InterfaceInfo{Interface: &net.Interface{}}
+	for i, tt := range parseInterfaceNameTests {
+		if _, err := ifi.parseName(tt.b); err != tt.error {
+			t.Errorf("#%d: got %v; want %v", i, err, tt.error)
+		}
+	}
+}

icmp/interface.go

@@ -174,6 +174,9 @@ func (ifi *InterfaceInfo) parseName(b []byte) ([]byte, error) {
 		return nil, errMessageTooShort
 	}
 	l := int(b[0])
+	if l%4 != 0 || 4 > l || l > 64 {
+		return nil, errInvalidExtension
+	}
 	var name [63]byte
 	copy(name[:], b[1:l])
 	ifi.Interface.Name = strings.Trim(string(name[:]), "\000")

icmp/message.go

@@ -24,11 +24,12 @@ import (
 )
 
 var (
-	errMessageTooShort = errors.New("message too short")
-	errHeaderTooShort  = errors.New("header too short")
-	errBufferTooShort  = errors.New("buffer too short")
-	errOpNoSupport     = errors.New("operation not supported")
-	errNoExtension     = errors.New("no extension")
+	errMessageTooShort  = errors.New("message too short")
+	errHeaderTooShort   = errors.New("header too short")
+	errBufferTooShort   = errors.New("buffer too short")
+	errOpNoSupport      = errors.New("operation not supported")
+	errNoExtension      = errors.New("no extension")
+	errInvalidExtension = errors.New("invalid extension")
 )
 
 func checksum(b []byte) uint16 {