diff options
| author | Michael Brown | 2007-09-08 20:30:25 +0200 |
|---|---|---|
| committer | Michael Brown | 2007-09-08 20:30:25 +0200 |
| commit | 972f293e46d936ade9613abfeb0953936f7389a5 (patch) | |
| tree | c4899f3292e0208e45844c6795b010ccca3d66c7 /src/net/udp/tftp.c | |
| parent | Re-added the kpxe prefix. I have no idea when this disappeared. (diff) | |
| download | ipxe-972f293e46d936ade9613abfeb0953936f7389a5.tar.gz ipxe-972f293e46d936ade9613abfeb0953936f7389a5.tar.xz ipxe-972f293e46d936ade9613abfeb0953936f7389a5.zip | |
Check for correct block number in tftp_rx_data().
(Problem observed by Clay McClure in VMware Fusion.)
Diffstat (limited to 'src/net/udp/tftp.c')
| -rw-r--r-- | src/net/udp/tftp.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/net/udp/tftp.c b/src/net/udp/tftp.c index 74c8c0a5..194c533d 100644 --- a/src/net/udp/tftp.c +++ b/src/net/udp/tftp.c @@ -415,7 +415,7 @@ static int tftp_rx_oack ( struct tftp_request *tftp, void *buf, size_t len ) { static int tftp_rx_data ( struct tftp_request *tftp, struct io_buffer *iobuf ) { struct tftp_data *data = iobuf->data; - unsigned int block; + int block; size_t data_len; int rc; @@ -432,6 +432,14 @@ static int tftp_rx_data ( struct tftp_request *tftp, iob_pull ( iobuf, sizeof ( *data ) ); data_len = iob_len ( iobuf ); + /* Check for correct block */ + if ( block != ( tftp->state + 1 ) ) { + DBGC ( tftp, "TFTP %p received out-of-order block %d " + "(expecting %d)\n", tftp, block, ( tftp->state + 1 ) ); + free_iob ( iobuf ); + return 0; + } + /* Deliver data */ if ( ( rc = xfer_deliver_iob ( &tftp->xfer, iobuf ) ) != 0 ) { DBGC ( tftp, "TFTP %p could not deliver data: %s\n", |