Re: [PATCH 3/4] net: tftp: use bounded string compare for OACK option parsing

[Tom Rini <trini@konsulko.com>]

[-- Attachment #1: Type: text/plain, Size: 1227 bytes --]

On Wed, Sep 09, 2026 at 12:20:15PM -0700, Sriram Sriram wrote:

> From: Drew Kluemke <ankluemk@microsoft.com>
> 
> The TFTP OACK handler matches option names in the received packet with
> strcasecmp(), which scans until a NUL byte. A malformed or truncated
> OACK packet may not contain a NUL within the received length, causing
> an out-of-bounds read past the packet buffer.
> 
> Replace each strcasecmp() with a strncasecmp() bounded to the option
> name length plus an explicit check that the name is NUL-terminated at
> the expected position. For the "windowsize" option, whose name and
> value extend beyond the loop's "i + 8 < len" guard, add an explicit
> "i + 11 < len" bound before the comparison.
> 
> Signed-off-by: Drew Kluemke <ankluemk@microsoft.com>
> Signed-off-by: Sriram Sriram <sriramsriram@linux.microsoft.com>
> ---
>  net/tftp.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)

Does the spec/RFC ensure that we're being given a NULL terminated string
here? It certainly makes sense to be using strncasecmp here, but since
we're a size constrained bootloader, we do need to find the right
balance between defense-in-depth and potential exposure.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]