Catch bad 'blocksize' or 'windowsize' responses from the server. Signed-off-by: Enrico Scholz <enrico.scholz@xxxxxxxxxxxxxxxxx> --- fs/tftp.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/fs/tftp.c b/fs/tftp.c index 400209c26023..c6491b537481 100644 --- a/fs/tftp.c +++ b/fs/tftp.c @@ -290,7 +290,7 @@ static int tftp_poll(struct file_priv *priv) return 0; } -static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len) +static int tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len) { unsigned char *opt, *val, *s; @@ -307,7 +307,7 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len) opt = s; val = s + strlen(s) + 1; if (val > s + len) - return; + break; if (!strcmp(opt, "tsize")) priv->filesize = simple_strtoull(val, NULL, 10); if (!strcmp(opt, "blksize")) @@ -317,6 +317,15 @@ static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len) pr_debug("OACK opt: %s val: %s\n", opt, val); s = val + strlen(val) + 1; } + + if (priv->blocksize > TFTP_MTU_SIZE || + priv->windowsize > TFTP_MAX_WINDOW_SIZE || + priv->windowsize == 0) { + pr_warn("tftp: invalid oack response"); + return -EINVAL; + } + + return 0; } static void tftp_timer_reset(struct file_priv *priv) @@ -498,10 +507,12 @@ static void tftp_recv(struct file_priv *priv, break; case TFTP_OACK: - tftp_parse_oack(priv, pkt, len); priv->tftp_con->udp->uh_dport = uh_sport; - if (priv->push) { + if (tftp_parse_oack(priv, pkt, len) < 0) { + priv->err = -EINVAL; + priv->state = STATE_DONE; + } else if (priv->push) { /* send first block */ priv->state = STATE_WDATA; priv->block = 1; -- 2.36.1