From: Manoel Rebelo Abranches <mrabran@br.ibm.com>
Date: Tue, 10 May 2011 17:07:20 +0000 (-0300)
Subject: Prevente error in broken cards by limiting data size.
X-Git-Tag: 2.00~1195^2~13
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0696f08f9238087edf5c1f1b91779f7515e7aeb5;p=thirdparty%2Fgrub.git

Prevente error in broken cards by limiting data size.
---

diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c
index cafb30585..6cc281085 100644
--- a/grub-core/net/tftp.c
+++ b/grub-core/net/tftp.c
@@ -126,8 +126,12 @@ tftp_receive (grub_net_socket_t sock, struct grub_net_buff *nb)
       if (grub_be_to_cpu16 (tftph->u.data.block) == data->block + 1)
 	{
 	  data->block++;
-	  if (nb->tail - nb->data < 1024)
+	  unsigned size = nb->tail - nb->data;
+	  if (size < 1024)
 	    sock->status = 2;
+	  /* Prevent garbage in broken cards.  */
+	  if (size > 1024)
+	    grub_netbuff_unput (nb, size - 1024); 
 	}
       else
 	grub_netbuff_clear(nb);