31283b4a8d
When sending frame shorter than 60 octets, we add trailing \0's to payload to construct 60-octet frame. rge.c rev 1.4--1.7 did this tail-padding on buffer provided by caller, which results in memory corruption if buffer is shorter than 60 bytes. Instead, allocate temporary buffer on stack, and work on it. This bug affects tftp_getnextblock() compiled by GCC8 and later, by which stack layout has drastically changed. However, even with GCC7, if tftp.c is compiled with -O0, the bug becomes tangible. |
||
|---|---|---|
| .. | ||
| altboot | ||
| Makefile | ||
| Makefile.inc | ||