From: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
To: barebox@lists.infradead.org
Cc: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Subject: [PATCH v2 13/13] tftp: add sanity check for OACK response
Date: Sun, 31 Jul 2022 13:36:45 +0200 [thread overview]
Message-ID: <20220731113645.4092241-2-enrico.scholz@sigma-chemnitz.de> (raw)
In-Reply-To: <e6880d7e8421f02f41802ae6d91533a5c8d7019b.1658144543.git.enrico.scholz@sigma-chemnitz.de>
Catch bad 'blocksize' or 'windowsize' responses from the server.
Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
---
fs/tftp.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/fs/tftp.c b/fs/tftp.c
index cfeb94b21..93b0606d3 100644
--- a/fs/tftp.c
+++ b/fs/tftp.c
@@ -292,7 +292,7 @@ static int tftp_poll(struct file_priv *priv)
return 0;
}
-static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
+static int tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
{
unsigned char *opt, *val, *s;
@@ -309,7 +309,7 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
opt = s;
val = s + strlen(s) + 1;
if (val > s + len)
- return;
+ break;
if (!strcmp(opt, "tsize"))
priv->filesize = simple_strtoull(val, NULL, 10);
if (!strcmp(opt, "blksize"))
@@ -319,6 +319,15 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
pr_debug("OACK opt: %s val: %s\n", opt, val);
s = val + strlen(val) + 1;
}
+
+ if (priv->blocksize > TFTP_MTU_SIZE ||
+ priv->windowsize > TFTP_MAX_WINDOW_SIZE ||
+ priv->windowsize == 0) {
+ pr_warn("tftp: invalid oack response\n");
+ return -EINVAL;
+ }
+
+ return 0;
}
static void tftp_timer_reset(struct file_priv *priv)
@@ -500,10 +509,12 @@ static void tftp_recv(struct file_priv *priv,
break;
case TFTP_OACK:
- tftp_parse_oack(priv, pkt, len);
priv->tftp_con->udp->uh_dport = uh_sport;
- if (priv->push) {
+ if (tftp_parse_oack(priv, pkt, len) < 0) {
+ priv->err = -EINVAL;
+ priv->state = STATE_DONE;
+ } else if (priv->push) {
/* send first block */
priv->state = STATE_WDATA;
priv->block = 1;
--
2.37.1
next prev parent reply other threads:[~2022-07-31 11:39 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-18 12:22 [PATCH 00/13] add "windowsize" (RFC 7440) support for tftp Enrico Scholz
2022-07-18 12:22 ` [PATCH 01/13] progress: add close_progress() to display some statistics Enrico Scholz
2022-07-18 12:22 ` [PATCH 02/13] libfile:copy_file: show statistics in verbose mode Enrico Scholz
2022-07-18 12:22 ` [PATCH 03/13] tftp: minor refactoring of RRQ/WRQ packet generation code Enrico Scholz
2022-07-18 12:22 ` [PATCH 04/13] tftp: replace hardcoded blksize by global constant Enrico Scholz
2022-07-18 12:22 ` [PATCH 05/13] tftp: record whether tftp file is opened for lookup operation only Enrico Scholz
2022-07-18 12:22 ` [PATCH 06/13] tftp: reduce block size on lookup requests Enrico Scholz
2022-07-18 12:22 ` [PATCH 07/13] tftp: refactor data processing Enrico Scholz
2022-07-18 12:22 ` [PATCH 08/13] tftp: detect out-of-memory situations Enrico Scholz
2022-07-18 12:22 ` [PATCH 09/13] tftp: implement 'windowsize' (RFC 7440) support Enrico Scholz
2022-07-31 11:36 ` [PATCH v2 " Enrico Scholz
2022-08-09 8:49 ` Sascha Hauer
2022-08-09 9:28 ` Enrico Scholz
2022-08-09 9:52 ` Sascha Hauer
2022-07-18 12:22 ` [PATCH 10/13] tftp: do not use 'priv->block' for RRQ Enrico Scholz
2022-07-18 12:22 ` [PATCH 11/13] tftp: reorder tftp packets Enrico Scholz
2022-08-09 8:58 ` Sascha Hauer
2022-07-18 12:22 ` [PATCH 12/13] tftp: allow to change tftp port Enrico Scholz
2022-08-09 8:12 ` Sascha Hauer
2022-07-18 12:22 ` [PATCH 13/13] tftp: add sanity check for OACK response Enrico Scholz
2022-07-31 11:36 ` Enrico Scholz [this message]
2022-08-09 9:02 ` [PATCH 00/13] add "windowsize" (RFC 7440) support for tftp Sascha Hauer
2022-08-09 9:35 ` Enrico Scholz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220731113645.4092241-2-enrico.scholz@sigma-chemnitz.de \
--to=enrico.scholz@sigma-chemnitz.de \
--cc=barebox@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox