diff options
| author | Thomas Vegas <> | 2019-08-31 17:30:51 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2019-09-09 08:14:34 +0200 |
| commit | facb0e4662415b5f28163e853dc6742ac5fafb3d (patch) | |
| tree | 5ecad0420a09cb3ca331b2d9a5199c983c85db15 /lib/tftp.c | |
| parent | 82f3ba3806a34fe94dcf9e5c9b88deda6679ca1b (diff) | |
| download | curl-facb0e4662415b5f28163e853dc6742ac5fafb3d.tar.gz | |
tftp: Alloc maximum blksize, and use default unless OACK is received
Fixes potential buffer overflow from 'recvfrom()', should the server
return an OACK without blksize.
Bug: https://curl.haxx.se/docs/CVE-2019-5482.html
CVE-2019-5482
Diffstat (limited to 'lib/tftp.c')
| -rw-r--r-- | lib/tftp.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/lib/tftp.c b/lib/tftp.c index a7176cec8..346f293dc 100644 --- a/lib/tftp.c +++ b/lib/tftp.c @@ -985,6 +985,7 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done) { tftp_state_data_t *state; int blksize; + int need_blksize; blksize = TFTP_BLKSIZE_DEFAULT; @@ -999,15 +1000,20 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done) return CURLE_TFTP_ILLEGAL; } + need_blksize = blksize; + /* default size is the fallback when no OACK is received */ + if(need_blksize < TFTP_BLKSIZE_DEFAULT) + need_blksize = TFTP_BLKSIZE_DEFAULT; + if(!state->rpacket.data) { - state->rpacket.data = calloc(1, blksize + 2 + 2); + state->rpacket.data = calloc(1, need_blksize + 2 + 2); if(!state->rpacket.data) return CURLE_OUT_OF_MEMORY; } if(!state->spacket.data) { - state->spacket.data = calloc(1, blksize + 2 + 2); + state->spacket.data = calloc(1, need_blksize + 2 + 2); if(!state->spacket.data) return CURLE_OUT_OF_MEMORY; @@ -1021,7 +1027,7 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done) state->sockfd = state->conn->sock[FIRSTSOCKET]; state->state = TFTP_STATE_START; state->error = TFTP_ERR_NONE; - state->blksize = blksize; + state->blksize = TFTP_BLKSIZE_DEFAULT; /* Unless updated by OACK response */ state->requested_blksize = blksize; ((struct sockaddr *)&state->local_addr)->sa_family = |