[PATCH v2 2/2] tftp: ignore trailing garbage in the request
Denys Vlasenko
vda.linux at googlemail.com
Wed Sep 3 16:36:36 UTC 2014
On Mon, Sep 1, 2014 at 10:24 PM, Aaro Koskinen <aaro.koskinen at iki.fi> wrote:
> The firmware in some HP PA-RISC boxes is always sending fixed
> 512-byte requests, and sometimes there is some garbage at the end
> which makes busybox to reject the request. Ignore any characters after
> the last NUL.
How about this?
result = recv_from_to(STDIN_FILENO,
G.block_buf, sizeof(G.block_buf) + 1,
/* ^^^ sizeof+1 to reliably detect oversized input */
0 /* flags */,
&peer_lsa->u.sa, &our_lsa->u.sa, our_lsa->len);
error_msg = "malformed packet";
opcode = ntohs(*(uint16_t*)G.block_buf);
if (result < 4 || result > sizeof(G.block_buf)
/*|| G.block_buf[result-1] != '\0' - bug compatibility, see below */
|| (IF_FEATURE_TFTP_PUT(opcode != TFTP_RRQ) /* not download */
IF_GETPUT(&&)
IF_FEATURE_TFTP_GET(opcode != TFTP_WRQ) /* not upload */
)
) {
goto err;
}
/* Some HP PA-RISC firmware always sends fixed 512-byte requests,
* with trailing garbage.
* Support that by not requiring NUL to be the last byte (see above).
* To make strXYZ() ops safe, force NUL termination:
*/
G.block_buf_tail[0] = '\0';
More information about the busybox
mailing list