Author: asomers
Date: Wed Aug 22 23:31:27 2018
New Revision: 338216
URL: https://svnweb.freebsd.org/changeset/base/338216

Log:
  tftpd: Fix data corruption bug with netascii
  
  Transferring files in netascii format requires, among other things,
  translating all CR characters to a CR,NUL pair. tftpd does this correctly
  except when the CR occurs as the last octet of a packet. In that case, it
  erroneously drops the NUL which should be part of the following packet. The
  bug was caused by using 0 as a sentinel value in a variable that could
  legitimately hold 0. Fix it by switching the sentinel value to -1.
  
  PR:           178055
  Reported by:  Richard <rsi...@gmail.com>
  Reviewed by:  cem
  MFC after:    2 weeks
  Differential Revision:        https://reviews.freebsd.org/D16853

Modified:
  head/libexec/tftpd/tftp-file.c

Modified: head/libexec/tftpd/tftp-file.c
==============================================================================
--- head/libexec/tftpd/tftp-file.c      Wed Aug 22 22:56:01 2018        
(r338215)
+++ head/libexec/tftpd/tftp-file.c      Wed Aug 22 23:31:27 2018        
(r338216)
@@ -110,10 +110,10 @@ convert_to_net(char *buffer, size_t count, int init)
 {
        size_t i;
        static size_t n = 0, in = 0;
-       static int newline = 0;
+       static int newline = -1;
 
        if (init) {
-               newline = 0;
+               newline = -1;
                n = 0;
                in = 0;
                return 0 ;
@@ -124,9 +124,9 @@ convert_to_net(char *buffer, size_t count, int init)
         */
        i = 0;
 
-       if (newline) {
+       if (newline != -1) {
                buffer[i++] = newline;
-               newline = 0;
+               newline = -1;
        }
 
        while (i < count) {
@@ -161,7 +161,7 @@ convert_to_net(char *buffer, size_t count, int init)
 
        if (i > count) {
                /*
-                * Whoops... that isn't alllowed (but it will happen
+                * Whoops... that isn't allowed (but it will happen
                 * when there is a CR or LF at the end of the buffer)
                 */
                newline = buffer[i-1];
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to