Page MenuHomeFreeBSD

tftpd: Add missing bounds checks
ClosedPublic

Authored by des on May 18 2026, 9:34 PM.
Tags
None
Referenced Files
F164824930: D57075.id178043.diff
Tue, Aug 4, 5:36 AM
F164821416: D57075.id178410.diff
Tue, Aug 4, 5:15 AM
F164820097: D57075.id178045.diff
Tue, Aug 4, 5:08 AM
F164807282: D57075.id178410.diff
Tue, Aug 4, 3:40 AM
F164799094: D57075.id178132.diff
Tue, Aug 4, 2:45 AM
Unknown Object (File)
Mon, Aug 3, 12:59 AM
Unknown Object (File)
Tue, Jul 28, 10:19 PM
Unknown Object (File)
Mon, Jul 27, 2:08 PM
Subscribers

Details

Summary

In send_[rw]rq(), we were using strlcpy() to avoid overflowing our
packet buffer, then failing to check the result and blithely advancing
our pointer by the full length.

Luckily, this code is only ever used by tftp(1), not tftpd(8).

MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

des requested review of this revision.May 18 2026, 9:34 PM
libexec/tftpd/tftp-io.c
195

Shouldn't this be >=?

201

Same here and below.

libexec/tftpd/tftp-io.c
195

Correct, I forgot to adjust it after removing the termination code.

des marked 2 inline comments as done.May 19 2026, 8:31 PM
This revision is now accepted and ready to land.May 19 2026, 8:48 PM
This revision was automatically updated to reflect the committed changes.