romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-10 03:37:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

tftp: only check address if it was stored

Browse source 
If recvfrom() fails, it might not have stored an address.

Follow-up to c4f9977c66

Pointed out by CodeSonar

Closes #18738
This commit is contained in:
Daniel Stenberg 2025-09-25 16:19:56 +02:00
parent bebc8df0f7
commit 9f75603d4f
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 14 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

26
lib/tftp.c
View file

@ -1106,19 +1106,21 @@ static CURLcode tftp_receive_packet(struct Curl_easy *data,
0,
(struct sockaddr *)&remote_addr,
&fromlen);
if(state->remote_pinned) {
/* pinned, verify that it comes from the same address */
if((state->remote_addrlen != fromlen) ||
memcmp(&remote_addr, &state->remote_addr, fromlen)) {
failf(data, "Data received from another address");
return CURLE_RECV_ERROR;
if(fromlen) {
if(state->remote_pinned) {
/* pinned, verify that it comes from the same address */
if((state->remote_addrlen != fromlen) ||
memcmp(&remote_addr, &state->remote_addr, fromlen)) {
failf(data, "Data received from another address");
return CURLE_RECV_ERROR;
}
}
else {
/* pin address on first use */
state->remote_pinned = TRUE;
state->remote_addrlen = fromlen;
memcpy(&state->remote_addr, &remote_addr, fromlen);
}
}
else {
/* pin address on first use */
state->remote_pinned = TRUE;
state->remote_addrlen = fromlen;
memcpy(&state->remote_addr, &remote_addr, fromlen);
}
/* Sanity check packet length */