Revision b55266b5 slirp/tftp.c
| b/slirp/tftp.c | ||
|---|---|---|
| 149 | 149 |
m->m_data += sizeof(struct udpiphdr); |
| 150 | 150 |
|
| 151 | 151 |
tp->tp_op = htons(TFTP_OACK); |
| 152 |
n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s", key) + 1; |
|
| 153 |
n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u", value) + 1; |
|
| 152 |
n += snprintf((char *)tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s", |
|
| 153 |
key) + 1; |
|
| 154 |
n += snprintf((char *)tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u", |
|
| 155 |
value) + 1; |
|
| 154 | 156 |
|
| 155 | 157 |
saddr.sin_addr = recv_tp->ip.ip_dst; |
| 156 | 158 |
saddr.sin_port = recv_tp->udp.uh_dport; |
| ... | ... | |
| 190 | 192 |
|
| 191 | 193 |
tp->tp_op = htons(TFTP_ERROR); |
| 192 | 194 |
tp->x.tp_error.tp_error_code = htons(errorcode); |
| 193 |
pstrcpy(tp->x.tp_error.tp_msg, sizeof(tp->x.tp_error.tp_msg), msg); |
|
| 195 |
pstrcpy((char *)tp->x.tp_error.tp_msg, sizeof(tp->x.tp_error.tp_msg), msg);
|
|
| 194 | 196 |
|
| 195 | 197 |
saddr.sin_addr = recv_tp->ip.ip_dst; |
| 196 | 198 |
saddr.sin_port = recv_tp->udp.uh_dport; |
| ... | ... | |
| 325 | 327 |
/* do sanity checks on the filename */ |
| 326 | 328 |
|
| 327 | 329 |
if ((spt->filename[0] != '/') |
| 328 |
|| (spt->filename[strlen(spt->filename) - 1] == '/') |
|
| 329 |
|| strstr(spt->filename, "/../")) {
|
|
| 330 |
|| (spt->filename[strlen((char *)spt->filename) - 1] == '/')
|
|
| 331 |
|| strstr((char *)spt->filename, "/../")) {
|
|
| 330 | 332 |
tftp_send_error(spt, 2, "Access violation", tp); |
| 331 | 333 |
return; |
| 332 | 334 |
} |
| ... | ... | |
| 353 | 355 |
while (k < n) {
|
| 354 | 356 |
const char *key, *value; |
| 355 | 357 |
|
| 356 |
key = src + k; |
|
| 358 |
key = (char *)src + k;
|
|
| 357 | 359 |
k += strlen(key) + 1; |
| 358 | 360 |
|
| 359 | 361 |
if (k >= n) {
|
| ... | ... | |
| 361 | 363 |
return; |
| 362 | 364 |
} |
| 363 | 365 |
|
| 364 |
value = src + k; |
|
| 366 |
value = (char *)src + k;
|
|
| 365 | 367 |
k += strlen(value) + 1; |
| 366 | 368 |
|
| 367 | 369 |
if (strcmp(key, "tsize") == 0) {
|
Also available in: Unified diff