[PATCH v2 13/13] tftp: add sanity check for OACK response

[Enrico Scholz]

Catch bad 'blocksize' or 'windowsize' responses from the server.

Signed-off-by: Enrico Scholz <enrico.sch...@sigma-chemnitz.de>
---
 fs/tftp.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/fs/tftp.c b/fs/tftp.c
index cfeb94b21..93b0606d3 100644
--- a/fs/tftp.c
+++ b/fs/tftp.c
@@ -292,7 +292,7 @@ static int tftp_poll(struct file_priv *priv)
        return 0;
 }
 
-static void tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int 
len)
+static int tftp_parse_oack(struct file_priv *priv, unsigned char *pkt, int len)
 {
        unsigned char *opt, *val, *s;
 
@@ -309,7 +309,7 @@ static void tftp_parse_oack(struct file_priv *priv, 
unsigned char *pkt, int len)
                opt = s;
                val = s + strlen(s) + 1;
                if (val > s + len)
-                       return;
+                       break;
                if (!strcmp(opt, "tsize"))
                        priv->filesize = simple_strtoull(val, NULL, 10);
                if (!strcmp(opt, "blksize"))
@@ -319,6 +319,15 @@ static void tftp_parse_oack(struct file_priv *priv, 
unsigned char *pkt, int len)
                pr_debug("OACK opt: %s val: %s\n", opt, val);
                s = val + strlen(val) + 1;
        }
+
+       if (priv->blocksize > TFTP_MTU_SIZE ||
+           priv->windowsize > TFTP_MAX_WINDOW_SIZE ||
+           priv->windowsize == 0) {
+               pr_warn("tftp: invalid oack response\n");
+               return -EINVAL;
+       }
+
+       return 0;
 }
 
 static void tftp_timer_reset(struct file_priv *priv)
@@ -500,10 +509,12 @@ static void tftp_recv(struct file_priv *priv,
                break;
 
        case TFTP_OACK:
-               tftp_parse_oack(priv, pkt, len);
                priv->tftp_con->udp->uh_dport = uh_sport;
 
-               if (priv->push) {
+               if (tftp_parse_oack(priv, pkt, len) < 0) {
+                       priv->err = -EINVAL;
+                       priv->state = STATE_DONE;
+               } else if (priv->push) {
                        /* send first block */
                        priv->state = STATE_WDATA;
                        priv->block = 1;
-- 
2.37.1