c78952
From 7d05a8298e6a54bfae0038841462443f21da3535 Mon Sep 17 00:00:00 2001
6f1e3d
From: Mark Salter <msalter@redhat.com>
6f1e3d
Date: Tue, 7 Mar 2017 18:26:17 -0500
31cddd
Subject: [PATCH] Fix malformed tftp packets
6f1e3d
6f1e3d
0088-Normalize-slashes-in-tftp-paths.patch collapses multiple contiguous
6f1e3d
slashes in a filename into one slash in the tftp packet filename field.
6f1e3d
However, the packet buffer pointer is advanced using the original name.
6f1e3d
This leaves unitialized data between the name field and the type field
6f1e3d
leading to tftp errors. Use the length of the normalized name to avoid
6f1e3d
this.
6f1e3d
6f1e3d
Signed-off-by: Mark Salter <msalter@redhat.com>
6f1e3d
---
6f1e3d
 grub-core/net/tftp.c | 4 ++--
6f1e3d
 1 file changed, 2 insertions(+), 2 deletions(-)
6f1e3d
6f1e3d
diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c
ec4acb
index 5ca0a96a6f6..dcd82494309 100644
6f1e3d
--- a/grub-core/net/tftp.c
6f1e3d
+++ b/grub-core/net/tftp.c
6f1e3d
@@ -360,8 +360,8 @@ tftp_open (struct grub_file *file, const char *filename)
6f1e3d
   /* Copy and normalize the filename to work-around issues on some tftp
6f1e3d
      servers when file names are being matched for remapping. */
6f1e3d
   grub_normalize_filename (rrq, filename);
6f1e3d
-  rrqlen += grub_strlen (filename) + 1;
6f1e3d
-  rrq += grub_strlen (filename) + 1;
6f1e3d
+  rrqlen += grub_strlen (rrq) + 1;
6f1e3d
+  rrq += grub_strlen (rrq) + 1;
6f1e3d
 
6f1e3d
   grub_strcpy (rrq, "octet");
6f1e3d
   rrqlen += grub_strlen ("octet") + 1;