[prev in list] [next in list] [prev in thread] [next in thread] 

List:       busybox
Subject:    [PATCH 1/2] tftp: fix off by one error
From:       Aaro Koskinen <aaro.koskinen () iki ! fi>
Date:       2014-07-26 16:53:52
Message-ID: 1406393633-7006-1-git-send-email-aaro.koskinen () iki ! fi
[Download RAW message or body]

RFC 2347 allows requests to be up to 512 bytes.

Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
---
 networking/tftp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/networking/tftp.c b/networking/tftp.c
index 630fdaf..b91ef5b 100644
--- a/networking/tftp.c
+++ b/networking/tftp.c
@@ -799,7 +799,7 @@ int tftpd_main(int argc UNUSED_PARAM, char **argv)
 
 	error_msg = "malformed packet";
 	opcode = ntohs(*(uint16_t*)G.block_buf);
-	if (result < 4 || result >= sizeof(G.block_buf)
+	if (result < 4 || result > sizeof(G.block_buf)
 	 || G.block_buf[result-1] != '\0'
 	 || (IF_FEATURE_TFTP_PUT(opcode != TFTP_RRQ) /* not download */
 	     IF_GETPUT(&&)
-- 
2.0.0

_______________________________________________
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox
[prev in list] [next in list] [prev in thread] [next in thread]