已合并
tftpc.c存在缓冲区越界读写 #1398
yang-pangyuan创建于 6月16日
tftpc.c存在缓冲区越界读写 #1398
已合并
共 1 个文件变更+2-2
| @@ -1646,7 +1646,7 @@ u32_t lwip_tftp_get_file_by_filename_to_rawmem(u32_t ulHostAddr, | |||
| 1646 | goto err_handler; | 1646 | goto err_handler; |
| 1647 | } | 1647 | } |
| 1648 | /* copy the last packet to the memory */ | 1648 | /* copy the last packet to the memory */ |
| 1649 | - if (memcpy_s(szDestMemAddr + ulMemOffset, TFTP_MAX_BLK_NUM * TFTP_BLKSIZE, | 1649 | + if (memcpy_s(szDestMemAddr + ulMemOffset, *ulFileLength - ulMemOffset, |
| 1650 | (void *)pstRecvBuf->u.stTFTP_Data.ucDataBuf, (size_t)ulRecvSize) != EOK) { | 1650 | (void *)pstRecvBuf->u.stTFTP_Data.ucDataBuf, (size_t)ulRecvSize) != EOK) { |
| 1651 | ulErrCode = TFTPC_MEMCPY_FAILURE; | 1651 | ulErrCode = TFTPC_MEMCPY_FAILURE; |
| 1652 | (void)lwip_close(iSockNum); | 1652 | (void)lwip_close(iSockNum); |
| @@ -1678,7 +1678,7 @@ u32_t lwip_tftp_get_file_by_filename_to_rawmem(u32_t ulHostAddr, | |||
| 1678 | *ulFileLength = ulMemOffset; | 1678 | *ulFileLength = ulMemOffset; |
| 1679 | goto err_handler; | 1679 | goto err_handler; |
| 1680 | } | 1680 | } |
| 1681 | - if (memcpy_s(szDestMemAddr + ulMemOffset, TFTP_MAX_BLK_NUM * TFTP_BLKSIZE, | 1681 | + if (memcpy_s(szDestMemAddr + ulMemOffset, *ulFileLength - ulMemOffset, |
| 1682 | (void *)pstRecvBuf->u.stTFTP_Data.ucDataBuf, (size_t)ulRecvSize) != EOK) { | 1682 | (void *)pstRecvBuf->u.stTFTP_Data.ucDataBuf, (size_t)ulRecvSize) != EOK) { |
| 1683 | ulErrCode = TFTPC_MEMCPY_FAILURE; | 1683 | ulErrCode = TFTPC_MEMCPY_FAILURE; |
| 1684 | (void)lwip_close(iSockNum); | 1684 | (void)lwip_close(iSockNum); |