From: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
To: barebox@lists.infradead.org
Cc: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Subject: [PATCH v3 09/18] tftp: add sanity check for OACK response
Date: Mon, 15 Aug 2022 10:42:13 +0200 [thread overview]
Message-ID: <903547f07c729bf1d942b0eb8781cb10643e4773.1660552646.git.enrico.scholz@sigma-chemnitz.de> (raw)
In-Reply-To: <cover.1660552646.git.enrico.scholz@sigma-chemnitz.de>
Catch bad 'blocksize' or 'windowsize' responses from the server.
Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
---
fs/tftp.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/fs/tftp.c b/fs/tftp.c
index 0b6d57c4603f..38a9e955ee92 100644
--- a/fs/tftp.c
+++ b/fs/tftp.c
@@ -218,7 +218,7 @@ static int tftp_poll(struct file_priv *priv)
return 0;
}
-static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
+static int tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
{
unsigned char *opt, *val, *s;
@@ -235,7 +235,7 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
opt = s;
val = s + strlen(s) + 1;
if (val > s + len)
- return;
+ break;
if (!strcmp(opt, "tsize"))
priv->filesize = simple_strtoull(val, NULL, 10);
if (!strcmp(opt, "blksize"))
@@ -243,6 +243,13 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
pr_debug("OACK opt: %s val: %s\n", opt, val);
s = val + strlen(val) + 1;
}
+
+ if (priv->blocksize > TFTP_MTU_SIZE) {
+ pr_warn("tftp: invalid oack response\n");
+ return -EINVAL;
+ }
+
+ return 0;
}
static void tftp_timer_reset(struct file_priv *priv)
@@ -295,8 +302,14 @@ static void tftp_recv(struct file_priv *priv,
break;
case TFTP_OACK:
- tftp_parse_oack(priv, pkt, len);
priv->tftp_con->udp->uh_dport = uh_sport;
+
+ if (tftp_parse_oack(priv, pkt, len) < 0) {
+ priv->err = -EINVAL;
+ priv->state = STATE_DONE;
+ break;
+ }
+
priv->state = STATE_START;
break;
--
2.37.1
next prev parent reply other threads:[~2022-08-15 8:47 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-15 8:42 [PATCH v3 00/18] add "windowsize" (RFC 7440) support for tftp Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 01/18] progress: add close_progress() to display some statistics Enrico Scholz
2022-08-19 7:21 ` Sascha Hauer
2022-08-19 7:53 ` Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 02/18] libfile:copy_file: show statistics in verbose mode Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 03/18] tftp: add some 'const' annotations Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 04/18] tftp: allow to change tftp port Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 05/18] cmd:tftp: add '-P' option to set tftp server port number Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 06/18] tftp: minor refactoring of RRQ/WRQ packet generation code Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 07/18] tftp: replace hardcoded blksize by global constant Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 08/18] tftp: allocate buffers and fifo dynamically Enrico Scholz
2022-08-15 8:42 ` Enrico Scholz [this message]
2022-08-15 8:42 ` [PATCH v3 10/18] tftp: record whether tftp file is opened for lookup operation only Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 11/18] tftp: reduce block size on lookup requests Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 12/18] tftp: refactor data processing Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 13/18] tftp: detect out-of-memory situations Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 14/18] tftp: implement 'windowsize' (RFC 7440) support Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 15/18] tftp: do not use 'priv->block' for RRQ Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 16/18] tftp: add debug_assert() macro Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 17/18] tftp: reorder tftp packets Enrico Scholz
2022-08-15 8:42 ` [PATCH v3 18/18] tftp: add selftest Enrico Scholz
2022-08-16 9:19 ` [PATCH v3 00/18] add "windowsize" (RFC 7440) support for tftp Sascha Hauer
2022-08-16 9:40 ` Enrico Scholz
2022-08-19 7:10 ` Sascha Hauer
2022-08-19 7:22 ` Sascha Hauer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=903547f07c729bf1d942b0eb8781cb10643e4773.1660552646.git.enrico.scholz@sigma-chemnitz.de \
--to=enrico.scholz@sigma-chemnitz.de \
--cc=barebox@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox