Page MenuHomeFreeBSD

tftpd: Add missing bounds checks
ClosedPublic

Authored by des on May 18 2026, 9:34 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Jun 20, 1:57 AM
Unknown Object (File)
Thu, Jun 18, 4:50 AM
Unknown Object (File)
Thu, Jun 11, 1:43 AM
Unknown Object (File)
Mon, Jun 8, 6:39 AM
Unknown Object (File)
Sun, Jun 7, 1:24 PM
Unknown Object (File)
Sun, Jun 7, 1:19 PM
Unknown Object (File)
Sun, Jun 7, 12:17 PM
Unknown Object (File)
Sun, Jun 7, 12:13 PM
Subscribers

Details

Summary

In send_[rw]rq(), we were using strlcpy() to avoid overflowing our
packet buffer, then failing to check the result and blithely advancing
our pointer by the full length.

Luckily, this code is only ever used by tftp(1), not tftpd(8).

MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 73207
Build 70090: arc lint + arc unit

Event Timeline

des requested review of this revision.May 18 2026, 9:34 PM
libexec/tftpd/tftp-io.c
195

Shouldn't this be >=?

201

Same here and below.

libexec/tftpd/tftp-io.c
195

Correct, I forgot to adjust it after removing the termination code.

des marked 2 inline comments as done.May 19 2026, 8:31 PM
This revision is now accepted and ready to land.May 19 2026, 8:48 PM
This revision was automatically updated to reflect the committed changes.