blob: 05fd8e9bcc7e67ceee6a15555eb7990bdc7aee6d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
From 2576003415625d7b5f0e390902f8097830b82275 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 3 May 2019 22:20:37 +0200
Subject: [PATCH] tftp: use the current blksize for recvfrom()
bug: https://curl.haxx.se/docs/CVE-2019-5436.html
Reported-by: l00p3r on hackerone
CVE-2019-5436
Upstream-Status: Backport
https://github.com/curl/curl/commit/2576003415625d7b5f0e390902f8097830b82275
CVE: CVE-2019-5436
affects: libcurl 7.19.4 to and including 7.64.1
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
lib/tftp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Index: curl-7.61.0/lib/tftp.c
===================================================================
--- curl-7.61.0.orig/lib/tftp.c
+++ curl-7.61.0/lib/tftp.c
@@ -1005,7 +1005,7 @@ static CURLcode tftp_connect(struct conn
state->sockfd = state->conn->sock[FIRSTSOCKET];
state->state = TFTP_STATE_START;
state->error = TFTP_ERR_NONE;
- state->blksize = TFTP_BLKSIZE_DEFAULT;
+ state->blksize = blksize;
state->requested_blksize = blksize;
((struct sockaddr *)&state->local_addr)->sa_family =
|
