[prev in list] [next in list] [prev in thread] [next in thread] 

List:       busybox
Subject:    [PATCH 2/2] tftp: ignore trailing garbage in the request
From:       Aaro Koskinen <aaro.koskinen () iki ! fi>
Date:       2014-07-26 16:53:53
Message-ID: 1406393633-7006-2-git-send-email-aaro.koskinen () iki ! fi
[Download RAW message or body]

The firmware in some HP PA-RISC boxes sending fixed 512-byte requests,
and sometimes there is some garbage at the end which makes busybox
to reject the request. Ignore any characters after the last NUL.

Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
---
 networking/tftp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/networking/tftp.c b/networking/tftp.c
index b91ef5b..1fcfd7a 100644
--- a/networking/tftp.c
+++ b/networking/tftp.c
@@ -757,7 +757,7 @@ int tftpd_main(int argc UNUSED_PARAM, char **argv)
 {
 	len_and_sockaddr *our_lsa;
 	len_and_sockaddr *peer_lsa;
-	char *local_file, *mode, *user_opt;
+	char *local_file, *mode, *user_opt, *last_nul;
 	const char *error_msg;
 	int opt, result, opcode;
 	IF_FEATURE_TFTP_BLOCKSIZE(int blksize = TFTP_BLKSIZE_DEFAULT;)
@@ -800,7 +800,7 @@ int tftpd_main(int argc UNUSED_PARAM, char **argv)
 	error_msg = "malformed packet";
 	opcode = ntohs(*(uint16_t*)G.block_buf);
 	if (result < 4 || result > sizeof(G.block_buf)
-	 || G.block_buf[result-1] != '\0'
+	 || !(last_nul = memrchr(G.block_buf + 3, 0, result - 3))
 	 || (IF_FEATURE_TFTP_PUT(opcode != TFTP_RRQ) /* not download */
 	     IF_GETPUT(&&)
 	     IF_FEATURE_TFTP_GET(opcode != TFTP_WRQ) /* not upload */
@@ -808,6 +808,7 @@ int tftpd_main(int argc UNUSED_PARAM, char **argv)
 	) {
 		goto err;
 	}
+	result = last_nul - G.block_buf + 1; /* limit the result to last NUL */
 	local_file = G.block_buf + 2;
 	if (local_file[0] == '.' || strstr(local_file, "/.")) {
 		error_msg = "dot in file name";
-- 
2.0.0

_______________________________________________
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox
[prev in list] [next in list] [prev in thread] [next in thread]