svn commit: r338216 - head/libexec/tftpd

[Alan Somers]

Author: asomers
Date: Wed Aug 22 23:31:27 2018
New Revision: 338216
URL: https://svnweb.freebsd.org/changeset/base/338216

Log:
  tftpd: Fix data corruption bug with netascii
  
  Transferring files in netascii format requires, among other things,
  translating all CR characters to a CR,NUL pair. tftpd does this correctly
  except when the CR occurs as the last octet of a packet. In that case, it
  erroneously drops the NUL which should be part of the following packet. The
  bug was caused by using 0 as a sentinel value in a variable that could
  legitimately hold 0. Fix it by switching the sentinel value to -1.
  
  PR:		178055
  Reported by:	Richard <rsitze at gmail.com>
  Reviewed by:	cem
  MFC after:	2 weeks
  Differential Revision:	https://reviews.freebsd.org/D16853

Modified:
  head/libexec/tftpd/tftp-file.c

Modified: head/libexec/tftpd/tftp-file.c
==============================================================================
--- head/libexec/tftpd/tftp-file.c	Wed Aug 22 22:56:01 2018	(r338215)
+++ head/libexec/tftpd/tftp-file.c	Wed Aug 22 23:31:27 2018	(r338216)
@@ -110,10 +110,10 @@ convert_to_net(char *buffer, size_t count, int init)
 {
 	size_t i;
 	static size_t n = 0, in = 0;
-	static int newline = 0;
+	static int newline = -1;
 
 	if (init) {
-		newline = 0;
+		newline = -1;
 		n = 0;
 		in = 0;
 		return 0 ;
@@ -124,9 +124,9 @@ convert_to_net(char *buffer, size_t count, int init)
 	 */
 	i = 0;
 
-	if (newline) {
+	if (newline != -1) {
 		buffer[i++] = newline;
-		newline = 0;
+		newline = -1;
 	}
 
 	while (i < count) {
@@ -161,7 +161,7 @@ convert_to_net(char *buffer, size_t count, int init)
 
 	if (i > count) {
 		/*
-		 * Whoops... that isn't alllowed (but it will happen
+		 * Whoops... that isn't allowed (but it will happen
 		 * when there is a CR or LF at the end of the buffer)
 		 */
 		newline = buffer[i-1];