On Wed, Sep 09, 2026 at 12:20:15PM -0700, Sriram Sriram wrote: > From: Drew Kluemke <[email protected]> > > The TFTP OACK handler matches option names in the received packet with > strcasecmp(), which scans until a NUL byte. A malformed or truncated > OACK packet may not contain a NUL within the received length, causing > an out-of-bounds read past the packet buffer. > > Replace each strcasecmp() with a strncasecmp() bounded to the option > name length plus an explicit check that the name is NUL-terminated at > the expected position. For the "windowsize" option, whose name and > value extend beyond the loop's "i + 8 < len" guard, add an explicit > "i + 11 < len" bound before the comparison. > > Signed-off-by: Drew Kluemke <[email protected]> > Signed-off-by: Sriram Sriram <[email protected]> > --- > net/tftp.c | 13 +++++++++---- > 1 file changed, 9 insertions(+), 4 deletions(-)
Does the spec/RFC ensure that we're being given a NULL terminated string here? It certainly makes sense to be using strncasecmp here, but since we're a size constrained bootloader, we do need to find the right balance between defense-in-depth and potential exposure. -- Tom
signature.asc
Description: PGP signature
