]> git.ipfire.org Git - thirdparty/grub.git/commit
net/tftp: Avoid a trivial UAF
authorDaniel Axtens <dja@axtens.net>
Tue, 18 Jan 2022 03:29:20 +0000 (14:29 +1100)
committerDaniel Kiper <daniel.kiper@oracle.com>
Tue, 7 Jun 2022 14:39:33 +0000 (16:39 +0200)
commit8f287c3e13da2bf82049e2e464eca7ca4fef0a85
tree40155494d1755a5516b66cd7e06269eedbd1fb93
parentee9652031491326736714a988fbbaeab8ef9255c
net/tftp: Avoid a trivial UAF

Under tftp errors, we print a tftp error message from the tftp header.
However, the tftph pointer is a pointer inside nb, the netbuff. Previously,
we were freeing the nb and then dereferencing it. Don't do that, use it
and then free it later.

This isn't really _bad_ per se, especially as we're single-threaded, but
it trips up fuzzers.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/net/tftp.c