Prevente error in broken cards by limiting data size.

diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c
index cafb305854c1d37102ad558e5ba5c8709a1560df..6cc2810855d5a8f1524cec46e0e7bb1d0b4a6560 100644 (file)
--- a/grub-core/net/tftp.c
+++ b/grub-core/net/tftp.c
@@ -126,8 +126,12 @@ tftp_receive (grub_net_socket_t sock, struct grub_net_buff *nb)
       if (grub_be_to_cpu16 (tftph->u.data.block) == data->block + 1)
        {
          data->block++;
-         if (nb->tail - nb->data < 1024)
+         unsigned size = nb->tail - nb->data;
+         if (size < 1024)
            sock->status = 2;
+         /* Prevent garbage in broken cards.  */
+         if (size > 1024)
+           grub_netbuff_unput (nb, size - 1024); 
        }
       else
        grub_netbuff_clear(nb);