diff options
| author | Enrico Scholz <enrico.scholz@sigma-chemnitz.de> | 2022-08-30 09:38:06 +0200 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2022-08-31 08:31:21 +0200 |
| commit | 56c5c40a52b7541f2b1379a1645bab2a33a8a83e (patch) | |
| tree | fcf26f3fc07b0a0886b98fa6a5f9de51e2492baa | |
| parent | 480ed057aacb5b6a3e1bdb88eaed360a295eb201 (diff) | |
| download | barebox-56c5c40a52b7541f2b1379a1645bab2a33a8a83e.tar.gz barebox-56c5c40a52b7541f2b1379a1645bab2a33a8a83e.tar.xz | |
tftp: add sanity check for OACK response
Catch bad 'blocksize' or 'windowsize' responses from the server.
Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Link: https://lore.barebox.org/20220830073816.2694734-12-enrico.scholz@sigma-chemnitz.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| -rw-r--r-- | fs/tftp.c | 19 |
1 files changed, 16 insertions, 3 deletions
@@ -229,7 +229,7 @@ static int tftp_poll(struct file_priv *priv) return 0; } -static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len) +static int tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len) { unsigned char *opt, *val, *s; @@ -246,7 +246,7 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len) opt = s; val = s + strlen(s) + 1; if (val > s + len) - return; + break; if (!strcmp(opt, "tsize")) priv->filesize = simple_strtoull(val, NULL, 10); if (!strcmp(opt, "blksize")) @@ -254,6 +254,13 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len) pr_debug("OACK opt: %s val: %s\n", opt, val); s = val + strlen(val) + 1; } + + if (priv->blocksize > TFTP_MTU_SIZE) { + pr_warn("tftp: invalid oack response\n"); + return -EINVAL; + } + + return 0; } static void tftp_timer_reset(struct file_priv *priv) @@ -349,8 +356,14 @@ static void tftp_recv(struct file_priv *priv, break; case TFTP_OACK: - tftp_parse_oack(priv, pkt, len); priv->tftp_con->udp->uh_dport = uh_sport; + + if (tftp_parse_oack(priv, pkt, len) < 0) { + priv->err = -EINVAL; + priv->state = STATE_DONE; + break; + } + priv->state = STATE_START; break; |