D60902.1794678379.diff
No OneTemporary
Actions

Authored By

Unknown

Size

773 B

Referenced Files

None

Subscribers

None

D60902.1794678379.diff
View Options

	diff --git a/libexec/tftpd/tftpd.c b/libexec/tftpd/tftpd.c
	--- a/libexec/tftpd/tftpd.c
	+++ b/libexec/tftpd/tftpd.c
	@@ -459,23 +459,24 @@
	char filename, char mode)
	{
	struct formats *pf;
	- char *cp;
	- size_t i;
	+ char cp, end;
	+ size_t len;

	*mode = NULL;
	cp = recvbuffer;
	+ end = recvbuffer + size;

	- i = get_field(peer, recvbuffer, size);
	- if (i >= PATH_MAX) {
	+ len = get_field(peer, cp, end - cp);
	+ if (len >= PATH_MAX) {
	tftp_log(LOG_ERR, "Bad option - filename too long");
	send_error(peer, EBADOP);
	exit(1);
	}
	*filename = recvbuffer;
	tftp_log(LOG_INFO, "Filename: '%s'", *filename);
	- cp += i;
	+ cp += len;

	- i = get_field(peer, cp, size);
	+ len = get_field(peer, cp, end - cp);
	*mode = cp;

	/* Find the file transfer mode */