Fix size_t underflow in ICMPv6 echo reply handler

prvProcessICMPMessage_IPv6() subtracted sizeof(ICMPEcho_IPv6_t) from
the IPv6 Payload Length without checking that the payload is at least
that large. When Payload Length is 0, the size_t subtraction wraps to
SIZE_MAX, causing the verification loop to read far past the buffer.

Add a minimum length check before the subtraction.

Author: archigup

source/FreeRTOS_ND.c

@@ -1081,6 +1081,11 @@
                                        break;
                                    }
 
+                                   if( uxDataLength < sizeof( *pxICMPEchoHeader ) )
+                                   {
+                                       break;
+                                   }
+
                                    uxDataLength = uxDataLength - sizeof( *pxICMPEchoHeader );
 
                                    /* Find the first byte of the data within the ICMP packet. */