diff -r 91f98dfbdc3f qemu-doc.texi
--- a/qemu-doc.texi	Thu Feb 15 21:22:02 2007 -0600
+++ b/qemu-doc.texi	Thu Feb 15 21:22:03 2007 -0600
@@ -438,13 +438,12 @@ override the default configuration (@opt
 override the default configuration (@option{-net nic -net user}) which
 is activated if no @option{-net} options are provided.
 
-@item -tftp prefix
+@item -tftp dir
 When using the user mode network stack, activate a built-in TFTP
-server. All filenames beginning with @var{prefix} can be downloaded
-from the host to the guest using a TFTP client. The TFTP client on the
-guest must be configured in binary mode (use the command @code{bin} of
-the Unix TFTP client). The host IP address on the guest is as usual
-10.0.2.2.
+server. The files in @var{dir} will be exposed as the root of a TFTP server.
+The TFTP client on the guest must be configured in binary mode (use the command
+@code{bin} of the Unix TFTP client). The host IP address on the guest is as
+usual 10.0.2.2.
 
 @item -bootp file
 When using the user mode network stack, broadcast @var{file} as the BOOTP
diff -r 91f98dfbdc3f slirp/tftp.c
--- a/slirp/tftp.c	Thu Feb 15 21:22:02 2007 -0600
+++ b/slirp/tftp.c	Thu Feb 15 21:22:03 2007 -0600
@@ -102,8 +102,15 @@ static int tftp_read_data(struct tftp_se
 {
   int fd;
   int bytes_read = 0;
-
-  fd = open(spt->filename, O_RDONLY | O_BINARY);
+  char buffer[1024];
+  int n;
+
+  n = snprintf(buffer, sizeof(buffer), "%s/%s",
+	       tftp_prefix, spt->filename);
+  if (n >= sizeof(buffer))
+    return -1;
+
+  fd = open(buffer, O_RDONLY | O_BINARY);
 
   if (fd < 0) {
     return -1;
@@ -328,8 +335,7 @@ static void tftp_handle_rrq(struct tftp_
 
   /* only allow exported prefixes */
 
-  if (!tftp_prefix
-      || (strncmp(spt->filename, tftp_prefix, strlen(tftp_prefix)) != 0)) {
+  if (!tftp_prefix) {
       tftp_send_error(spt, 2, "Access violation", tp);
       return;
   }
diff -r 91f98dfbdc3f vl.c
--- a/vl.c	Thu Feb 15 21:22:02 2007 -0600
+++ b/vl.c	Thu Feb 15 21:22:03 2007 -0600
@@ -6487,7 +6487,7 @@ void help(void)
            "                is provided, the default is '-net nic -net user'\n"
            "\n"
 #ifdef CONFIG_SLIRP
-           "-tftp prefix    allow tftp access to files starting with prefix [-net user]\n"
+           "-tftp dir       allow tftp access to files in dir [-net user]\n"
            "-bootp file     advertise file in BOOTP replies\n"
 #ifndef _WIN32
            "-smb dir        allow SMB access to files in 'dir' [-net user]\n"