Changeset 3621 in MondoRescue for branches/3.3/mindi-busybox/networking/tftp.c

Timestamp:

Dec 20, 2016, 4:07:32 PM (7 years ago)

Author:

Bruno Cornec

Message:

New 3?3 banch for incorporation of latest busybox 1.25. Changing minor version to handle potential incompatibilities.

Location:

branches/3.3

Files:

• . (copied) (copied from branches/3.2 )
• mindi-busybox/networking/tftp.c (modified) (8 diffs)

branches/3.3/mindi-busybox/networking/tftp.c

@@ -52 +52 @@
 
 #include "libbb.h"
+#include "common_bufsiz.h"
 #include <syslog.h>
 
@@ -118 +119 @@
     uint8_t error_pkt[4 + 32];
     struct passwd *pw;
-    /* used in tftpd_main(), a bit big for stack: */
-    char block_buf[TFTP_BLKSIZE_DEFAULT];
+    /* Used in tftpd_main() for initial packet */
+    /* Some HP PA-RISC firmware always sends fixed 516-byte requests */
+    char block_buf[516];
+    char block_buf_tail[1];
 #if ENABLE_FEATURE_TFTP_PROGRESS_BAR
     off_t pos;
@@ -127 +130 @@
 #endif
 } FIX_ALIASING;
-#define G (*(struct globals*)&bb_common_bufsiz1)
-struct BUG_G_too_big {
-    char BUG_G_too_big[sizeof(G) <= COMMON_BUFSIZE ? 1 : -1];
-};
-#define INIT_G() do { } while (0)
+#define G (*(struct globals*)bb_common_bufsiz1)
+#define INIT_G() do { \
+    setup_common_bufsiz(); \
+    BUILD_BUG_ON(sizeof(G) > COMMON_BUFSIZE); \
+} while (0)
 
 #define G_error_pkt_reason (G.error_pkt[3])
@@ -347 +350 @@
             block_nr = 0;
         }
-
     } else { /* tftp */
         /* Open file (must be after changing user) */
@@ -758 +760 @@
     len_and_sockaddr *our_lsa;
     len_and_sockaddr *peer_lsa;
-    char *local_file, *mode, *user_opt;
+    char *mode, *user_opt;
+    char *local_file = local_file;
     const char *error_msg;
     int opt, result, opcode;
@@ -794 +797 @@
     }
 
-    result = recv_from_to(STDIN_FILENO, G.block_buf, sizeof(G.block_buf),
+    result = recv_from_to(STDIN_FILENO,
+            G.block_buf, sizeof(G.block_buf) + 1,
+            /* ^^^ sizeof+1 to reliably detect oversized input */
             0 /* flags */,
             &peer_lsa->u.sa, &our_lsa->u.sa, our_lsa->len);
@@ -800 +805 @@
     error_msg = "malformed packet";
     opcode = ntohs(*(uint16_t*)G.block_buf);
-    if (result < 4 || result >= sizeof(G.block_buf)
-     || G.block_buf[result-1] != '\0'
+    if (result < 4 || result > sizeof(G.block_buf)
+    /*|| G.block_buf[result-1] != '\0' - bug compatibility, see below */
      || (IF_FEATURE_TFTP_PUT(opcode != TFTP_RRQ) /* not download */
          IF_GETPUT(&&)
@@ -809 +814 @@
         goto err;
     }
+    /* Some HP PA-RISC firmware always sends fixed 516-byte requests,
+     * with trailing garbage.
+     * Support that by not requiring NUL to be the last byte (see above).
+     * To make strXYZ() ops safe, force NUL termination:
+     */
+    G.block_buf_tail[0] = '\0';
+
     local_file = G.block_buf + 2;
     if (local_file[0] == '.' || strstr(local_file, "/.")) {