Heinrich Schuchardt 10917df17f net: lwip: tftp: fix find_option() ... Find_option() is used to retrieve the block size value in an option acknowledgment in response to a request containing a block size option according to RFC2348. The format of an OACK response is described in RFC2347 as +-------+---~~---+---+---~~---+---+---~~---+---+---~~---+---+ | opc | opt1 | 0 | value1 | 0 | optN | 0 | valueN | 0 | +-------+---~~---+---+---~~---+---+---~~---+---+---~~---+---+ The current implementation of find_option() only works if * blksize is the first option * lwip_strnstr() ignores the length parameter, i.e. is implemented via strstr() The OACK messages starts with 0x00 0x06. If 'blksize' is the first option, strstr() reports a match when the first parameter points to 0x06. Adding the string length of 'blksize' plus 2 to the location of the 0x06 byte points to the value. Find_option() would report a match for option 'blksize' if the response contained an option called 'foo_blksize_bar'. In this case find_option() would return 'bar' as the value string. If 'blksize' were the second option, find_option() would return a pointer to the second character of the value string. Furthermore find_option() does not detect if the value string is NUL terminated. This may lead to a buffer overrun. Provide an implementation that correctly steps from option to option. Fixes: 27d7ccda94 ("net: lwip: tftp: add support of blksize option to client") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org> Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (qemu_arm64_lwip) Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>		2025-02-12 12:37:05 -06:00
..
lwip	net: lwip: tftp: fix find_option()	2025-02-12 12:37:05 -06:00
u-boot	net: disable MBEDTLS in SPL	2024-12-06 17:47:23 -06:00
Makefile	net: disable MBEDTLS in SPL	2024-12-06 17:47:23 -06:00