]> git.ipfire.org Git - thirdparty/grub.git/commit
net/tftp: Fix NULL pointer dereference in grub_net_udp_close()
authorLidong Chen <lidong.chen@oracle.com>
Fri, 17 Oct 2025 18:35:59 +0000 (18:35 +0000)
committerDaniel Kiper <daniel.kiper@oracle.com>
Fri, 24 Oct 2025 18:05:07 +0000 (20:05 +0200)
commitc2cae77abe4ffad2ec84e7f82ced123739429cf8
tree7042bfcbb49ba6637530e8f81f0eee3c9a4e5d1a
parentfadc94b919a2d35c3f81c3593004af14b4535701
net/tftp: Fix NULL pointer dereference in grub_net_udp_close()

A NULL pointer dereference can occur in grub_net_udp_close(data->sock)
when handling a malformed TFTP OACK packet.

This issue was discovered via fuzzing. When a malformed OACK packet
contains an invalid file size, "tsize", value tftp_receive() detects
the error and saves it via grub_error_save(&data->save_err). Later,
tftp_open() restores this error and calls grub_net_udp_close(data->sock)
assuming the socket is still valid.

However, the socket may have already been closed and set to NULL after
processing the final data block in tftp_receive() leading to a NULL
pointer dereference when attempting to close it again.

Fix it by checking if the socket is non-NULL before closing.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
grub-core/net/tftp.c