]> git.ipfire.org Git - thirdparty/u-boot.git/commit
net: lwip: tftp: Do not write past buffer end
authorAndrew Goodbody <andrew.goodbody@linaro.org>
Wed, 14 Jan 2026 15:12:09 +0000 (15:12 +0000)
committerJerome Forissier <jerome.forissier@arm.com>
Wed, 4 Feb 2026 08:04:36 +0000 (09:04 +0100)
commit8df6b78746ee1f4f0bb750aec9c4da2fb31d3e33
tree6726cfacc560cd604a1bec0c3245ebb345ca66bc
parentf2566c3a71a541a5bdd34b78a9d33934f6925154
net: lwip: tftp: Do not write past buffer end

sprintf will add a trailing \0 so manually adding a trailing \0 will
result in an extra unaccounted for character being written. This
overwrote the first byte of the following allocation block resulting in
unexpected behavior.

This was found by Running 'pxe get' with no available file resulting in
multiple attempts, using the default algorithm, to attempt to find a file.
Eventually there would be a failed assert when free() was called.
Failing the assert would result in a system reset.

Fixes: 27d7ccda94fa ("net: lwip: tftp: add support of blksize option to client")
Reported-by: Michal Simek <michal.simek@amd.com>
Tested-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Tested-by: Tom Rini <trini@konsulko.com> # Pine64+
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
lib/lwip/lwip/src/apps/tftp/tftp.c