When parsing a header, keep track of the length of the unparsed portion
and pass that to get_field() instead of the length of the entire header.
Reported by: n0ps1ed
MFC after: 1 week
Details
Details
- Reviewers
emaste markj - Commits
- rG579e428a551a: tftpd: Keep proper track of header length
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
parse_options() has the same bugs as this function, will you fix it too?
| libexec/tftpd/tftpd.c | ||
|---|---|---|
| 469–470 | BTW, get_field() is a bit sloppy, it can read one byte beyond the end of the buffer and return a value larger than size. | |
| libexec/tftpd/tftpd.c | ||
|---|---|---|
| 469–470 | OK but it's not supposed to, so I don't think it's wrong to assume that it doesn't here. | |
| libexec/tftpd/tftpd.c | ||
|---|---|---|
| 469–470 | Yeah, it's definitely a bug. | |