|
 |
78e1a10 |
From af0e4fc8f9cd844c44c969c0991269ec9ab01a62 Mon Sep 17 00:00:00 2001
|
|
|
6f1e3d5 |
From: Mark Salter <msalter@redhat.com>
|
|
|
6f1e3d5 |
Date: Tue, 7 Mar 2017 18:26:17 -0500
|
|
|
78e1a10 |
Subject: [PATCH 148/216] Fix malformed tftp packets
|
|
|
6f1e3d5 |
|
|
|
6f1e3d5 |
0088-Normalize-slashes-in-tftp-paths.patch collapses multiple contiguous
|
|
|
6f1e3d5 |
slashes in a filename into one slash in the tftp packet filename field.
|
|
|
6f1e3d5 |
However, the packet buffer pointer is advanced using the original name.
|
|
|
6f1e3d5 |
This leaves unitialized data between the name field and the type field
|
|
|
6f1e3d5 |
leading to tftp errors. Use the length of the normalized name to avoid
|
|
|
6f1e3d5 |
this.
|
|
|
6f1e3d5 |
|
|
|
6f1e3d5 |
Signed-off-by: Mark Salter <msalter@redhat.com>
|
|
|
6f1e3d5 |
---
|
|
|
6f1e3d5 |
grub-core/net/tftp.c | 4 ++--
|
|
|
6f1e3d5 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
6f1e3d5 |
|
|
|
6f1e3d5 |
diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c
|
|
|
ec4acbb |
index 5ca0a96a6f6..dcd82494309 100644
|
|
|
6f1e3d5 |
--- a/grub-core/net/tftp.c
|
|
|
6f1e3d5 |
+++ b/grub-core/net/tftp.c
|
|
|
6f1e3d5 |
@@ -360,8 +360,8 @@ tftp_open (struct grub_file *file, const char *filename)
|
|
|
6f1e3d5 |
/* Copy and normalize the filename to work-around issues on some tftp
|
|
|
6f1e3d5 |
servers when file names are being matched for remapping. */
|
|
|
6f1e3d5 |
grub_normalize_filename (rrq, filename);
|
|
|
6f1e3d5 |
- rrqlen += grub_strlen (filename) + 1;
|
|
|
6f1e3d5 |
- rrq += grub_strlen (filename) + 1;
|
|
|
6f1e3d5 |
+ rrqlen += grub_strlen (rrq) + 1;
|
|
|
6f1e3d5 |
+ rrq += grub_strlen (rrq) + 1;
|
|
|
6f1e3d5 |
|
|
|
6f1e3d5 |
grub_strcpy (rrq, "octet");
|
|
|
6f1e3d5 |
rrqlen += grub_strlen ("octet") + 1;
|
|
|
6f1e3d5 |
--
|
|
|
ec4acbb |
2.15.0
|
|
|
6f1e3d5 |
|