Author: asomers
Date: Mon Oct  1 16:11:09 2018
New Revision: 339062
URL: https://svnweb.freebsd.org/changeset/base/339062
Log:
  MFC r338216:
  
  tftpd: Fix data corruption bug with netascii
  
  Transferring files in netascii format requires, among other things,
  translating all CR characters to a CR,NUL pair. tftpd does this correctly
  except when the CR occurs as the last octet of a packet. In that case, it
  erroneously drops the NUL which should be part of the following packet. The
  bug was caused by using 0 as a sentinel value in a variable that could
  legitimately hold 0. Fix it by switching the sentinel value to -1.
  
  PR:           178055
  Reported by:  Richard <rsi...@gmail.com>
  Reviewed by:  cem
  Differential Revision:        https://reviews.freebsd.org/D16853

Modified:
  stable/10/libexec/tftpd/tftp-file.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/libexec/tftpd/tftp-file.c
==============================================================================
--- stable/10/libexec/tftpd/tftp-file.c Mon Oct  1 16:10:27 2018        
(r339061)
+++ stable/10/libexec/tftpd/tftp-file.c Mon Oct  1 16:11:09 2018        
(r339062)
@@ -108,10 +108,10 @@ convert_to_net(char *buffer, size_t count, int init)
 {
        size_t i;
        static size_t n = 0, in = 0;
-       static int newline = 0;
+       static int newline = -1;
 
        if (init) {
-               newline = 0;
+               newline = -1;
                n = 0;
                in = 0;
                return 0 ;
@@ -122,9 +122,9 @@ convert_to_net(char *buffer, size_t count, int init)
         */
        i = 0;
 
-       if (newline) {
+       if (newline != -1) {
                buffer[i++] = newline;
-               newline = 0;
+               newline = -1;
        }
 
        while (i < count) {
@@ -159,7 +159,7 @@ convert_to_net(char *buffer, size_t count, int init)
 
        if (i > count) {
                /*
-                * Whoops... that isn't alllowed (but it will happen
+                * Whoops... that isn't allowed (but it will happen
                 * when there is a CR or LF at the end of the buffer)
                 */
                newline = buffer[i-1];
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"

Reply via email to