tftpd: fix bugs spotted by Vladimir

1 files changed, 12 insertions, 3 deletions

diff --git a/networking/tftp.c b/networking/tftp.c
index 23a2413..25001c2 100644
--- a/networking/tftp.c
+++ b/networking/tftp.c
@@ -16,7 +16,7 @@
  *
  * utftp:  Copyright (C) 1999 Uwe Ohse <uwe@ohse.de>
  *
- * tftpd added by Denys Vlasenko
+ * tftpd added by Denys Vlasenko & Vladimir Dronnikov
  *
  * Licensed under GPLv2 or later, see file LICENSE in this tarball for details.
  * ------------------------------------------------------------------------- */
@@ -145,9 +145,9 @@ static int tftp_protocol(
 	socket_fd = xsocket(peer_lsa->u.sa.sa_family, SOCK_DGRAM, 0);
 	setsockopt_reuseaddr(socket_fd);
 
+	block_nr = 1;
 	if (!ENABLE_TFTP || our_lsa) {
 		/* tftpd */
-		block_nr = 0;
 
 		/* Create a socket which is:
 		 * 1. bound to IP:port peer sent 1st datagram to,
@@ -158,9 +158,17 @@ static int tftp_protocol(
 		xbind(socket_fd, &our_lsa->u.sa, our_lsa->len);
 		xconnect(socket_fd, &peer_lsa->u.sa, peer_lsa->len);
 
+		if (CMD_GET(cmd)) {
+			/* it's upload - we must ACK 1st packet (with filename)
+			 * as if it's "block 0" */
+			block_nr = 0;
+		}
+
 #if ENABLE_FEATURE_TFTP_BLOCKSIZE
 		if (blocksize != TFTP_BLOCKSIZE_DEFAULT) {
 			/* Create and send OACK packet */
+			/* block_nr is still 1, we expect ACK to (block_nr-1),
+			 * that is, to "block 0" */
 			opcode = TFTP_OACK;
 			cp = xbuf + 2;
 			goto add_blksize_opt;
@@ -169,7 +177,6 @@ static int tftp_protocol(
 #endif
 	} else {
 		/* tftp */
-		block_nr = 1;
 
 		/* We can't (and don't really need to) bind the socket:
 		 * we don't know from which local IP datagrams will be sent,
@@ -288,6 +295,8 @@ static int tftp_protocol(
 				bb_perror_msg("read");
 				goto ret;
 			}
+			if (len < 4) /* too small? */
+				goto recv_again;
 			goto process_pkt;
 		case 0:
 			retries--;