igmp: Refresh the ip header pointer after m_pullup()

There is a chance that the m_pullup() call immediately above invalidated
the "ip" pointer, so refresh it as we do with the IGMP header.
Otherwise the test in igmp_input_v3_query() for whether the packet is an
IGMPv3 general query might use a pointer to a freed mbuf.

MFC after:	1 week
Sponsored by:	The FreeBSD Foundation

sys/netinet/igmp.c

@@ -1605,6 +1605,7 @@ igmp_input(struct mbuf **mp, int *offp, int proto)
 				IGMPSTAT_INC(igps_rcv_tooshort);
 				return (IPPROTO_DONE);
 			}
+			ip = mtod(m, struct ip *);
 			igmpv3 = (struct igmpv3 *)(mtod(m, uint8_t *) + iphlen);
 			if (igmp_input_v3_query(ifp, ip, igmpv3) != 0) {
 				m_freem(m);