mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
To: barebox@lists.infradead.org
Cc: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Subject: [PATCH v3 09/18] tftp: add sanity check for OACK response
Date: Mon, 15 Aug 2022 10:42:13 +0200	[thread overview]
Message-ID: <903547f07c729bf1d942b0eb8781cb10643e4773.1660552646.git.enrico.scholz@sigma-chemnitz.de> (raw)
In-Reply-To: <cover.1660552646.git.enrico.scholz@sigma-chemnitz.de>

Catch bad 'blocksize' or 'windowsize' responses from the server.

Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
---
 fs/tftp.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/fs/tftp.c b/fs/tftp.c
index 0b6d57c4603f..38a9e955ee92 100644
--- a/fs/tftp.c
+++ b/fs/tftp.c
@@ -218,7 +218,7 @@ static int tftp_poll(struct file_priv *priv)
 	return 0;
 }
 
-static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
+static int tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
 {
 	unsigned char *opt, *val, *s;
 
@@ -235,7 +235,7 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
 		opt = s;
 		val = s + strlen(s) + 1;
 		if (val > s + len)
-			return;
+			break;
 		if (!strcmp(opt, "tsize"))
 			priv->filesize = simple_strtoull(val, NULL, 10);
 		if (!strcmp(opt, "blksize"))
@@ -243,6 +243,13 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
 		pr_debug("OACK opt: %s val: %s\n", opt, val);
 		s = val + strlen(val) + 1;
 	}
+
+	if (priv->blocksize > TFTP_MTU_SIZE) {
+		pr_warn("tftp: invalid oack response\n");
+		return -EINVAL;
+	}
+
+	return 0;
 }
 
 static void tftp_timer_reset(struct file_priv *priv)
@@ -295,8 +302,14 @@ static void tftp_recv(struct file_priv *priv,
 		break;
 
 	case TFTP_OACK:
-		tftp_parse_oack(priv, pkt, len);
 		priv->tftp_con->udp->uh_dport = uh_sport;
+
+		if (tftp_parse_oack(priv, pkt, len) < 0) {
+			priv->err = -EINVAL;
+			priv->state = STATE_DONE;
+			break;
+		}
+
 		priv->state = STATE_START;
 		break;
 
-- 
2.37.1




  parent reply	other threads:[~2022-08-15  8:47 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-15  8:42 [PATCH v3 00/18] add "windowsize" (RFC 7440) support for tftp Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 01/18] progress: add close_progress() to display some statistics Enrico Scholz
2022-08-19  7:21   ` Sascha Hauer
2022-08-19  7:53     ` Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 02/18] libfile:copy_file: show statistics in verbose mode Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 03/18] tftp: add some 'const' annotations Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 04/18] tftp: allow to change tftp port Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 05/18] cmd:tftp: add '-P' option to set tftp server port number Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 06/18] tftp: minor refactoring of RRQ/WRQ packet generation code Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 07/18] tftp: replace hardcoded blksize by global constant Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 08/18] tftp: allocate buffers and fifo dynamically Enrico Scholz
2022-08-15  8:42 ` Enrico Scholz [this message]
2022-08-15  8:42 ` [PATCH v3 10/18] tftp: record whether tftp file is opened for lookup operation only Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 11/18] tftp: reduce block size on lookup requests Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 12/18] tftp: refactor data processing Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 13/18] tftp: detect out-of-memory situations Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 14/18] tftp: implement 'windowsize' (RFC 7440) support Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 15/18] tftp: do not use 'priv->block' for RRQ Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 16/18] tftp: add debug_assert() macro Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 17/18] tftp: reorder tftp packets Enrico Scholz
2022-08-15  8:42 ` [PATCH v3 18/18] tftp: add selftest Enrico Scholz
2022-08-16  9:19 ` [PATCH v3 00/18] add "windowsize" (RFC 7440) support for tftp Sascha Hauer
2022-08-16  9:40   ` Enrico Scholz
2022-08-19  7:10     ` Sascha Hauer
2022-08-19  7:22 ` Sascha Hauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=903547f07c729bf1d942b0eb8781cb10643e4773.1660552646.git.enrico.scholz@sigma-chemnitz.de \
    --to=enrico.scholz@sigma-chemnitz.de \
    --cc=barebox@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox