This is the mail archive of the mailing list for the eCos project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[Bug 1001522] Array index out of bounds in tftp_server.c

Please do not reply to this email. Use the web interface provided at:

Jonathan Larmour <> changed:

           What    |Removed                     |Added
                 CC|                            |

--- Comment #1 from Jonathan Larmour <> 2012-03-09 05:09:26 GMT ---
Yes there's a bug here, but it's not quite that. That inner loop _should_ go
and close both the ipv4 and ipv6 sockets, because once another thread wakes up
to be the tftp server, it will want to open new ones of each. We'd leak sockets
if we didn't close both. So that bit's ok.

However, if the client sends an unsupported opcode, then this bit runs:
the problem here being that we've just closed server->s[i]. So that's broken.
Either it should make a new socket and use that for sending, or send the error
before it closes this server socket. A cheaty solution is probably something

              int server_sock; // at top of function

              for (i=0; i < CYGNUM_NET_MAX_INET_PROTOS; i++) {
                if (server->s[i]) {
                  close (server->s[i]);
                  server->s[i] = 0;

It's all rather crufty code - there's a window where the server socket is
closed and hasn't been reopened (which will cause ICMP port unreachable
messages to be sent, not merely have the TFTP request be ignored). It shouldn't
be closed at all really, but that would require other changes too. And I
dislike the server handle being a cast to an int of the server address. The
whole setup just isn't very good.

Configure bugmail:
------- You are receiving this mail because: -------
You are on the CC list for the bug.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]