Fixed in https://git.savannah.nongnu.org/cgit/lwip.git/commit/?id=489405839ae0fea8b99c4896f632eb688dc8a19a

Type:
Buffer overflow

Description:
his bug is related to bug #58552. We have observed the changes made to the same place in the master branch. However, the bug still exists. The function pbuf_take_at() replaces the function SMEMCPY() in the master branch. However, it is still vulnerable.
The function pbuf_take_at() tries to copy fields from the original packet as shown in line 409 of icmp6.c. The parameter len of the function pbuf_take_at() is the length of another parameter dataptr. However, the function icmp6_send_response_with_addrs_and_netif() passes the parameters p->payload and p->tot_len to the function pbuf_take_at(), which are the total length of the p->payload plus all payloads length of its following pbuf . If p->tot_len is larger than the length of p->payload, the memory will leak to remote attackers through the network. To fix this, the datalen should be p->len, not p->tot_len.


385
static void icmp6_send_response_with_addrs_and_netif(struct pbuf *p, u8_t code, u32_t data, u8_t type, const ip6_addr_t *reply_src, const ip6_addr_t *reply_dest, struct netif *netif)
387
{

...
409
pbuf_take_at(q, p->payload, datalen, sizeof(struct icmp6_hdr));

...
423
}

Result:
Memory disclosure.