Merge commit 'u-boot/master' into for-1.3.1

[platform/kernel/u-boot.git] / net / tftp.c

diff --git a/net/tftp.c b/net/tftp.c
index d6db91c..8b95bcf 100644 (file)
--- a/net/tftp.c
+++ b/net/tftp.c
@@ -15,7 +15,7 @@
 #if defined(CONFIG_CMD_NET)
 
 #define WELL_KNOWN_PORT        69              /* Well known TFTP port #               */
-#define TIMEOUT                5               /* Seconds to timeout for a lost pkt    */
+#define TIMEOUT                5UL             /* Seconds to timeout for a lost pkt    */
 #ifndef        CONFIG_NET_RETRY_COUNT
 # define TIMEOUT_COUNT 10              /* # of timeouts before giving up  */
 #else
@@ -178,7 +178,7 @@ TftpSend (void)
                pkt += strlen((char *)pkt) + 1;
                /* try for more effic. blk size */
                pkt += sprintf((char *)pkt,"blksize%c%d%c",
-                               0,htons(TftpBlkSizeOption),0);
+                               0,TftpBlkSizeOption,0);
 #ifdef CONFIG_MCAST_TFTP
                /* Check all preconditions before even trying the option */
                if (!ProhibitMcast
@@ -276,8 +276,12 @@ TftpHandler (uchar * pkt, unsigned dest, unsigned src, unsigned len)
 #endif
                TftpState = STATE_OACK;
                TftpServerPort = src;
-               /* Check for 'blksize' option */
-               for (i=0;i<len-8;i++) {
+               /*
+                * Check for 'blksize' option.
+                * Careful: "i" is signed, "len" is unsigned, thus
+                * something like "len-8" may give a *huge* number
+                */
+               for (i=0; i+8<len; i++) {
                        if (strcmp ((char*)pkt+i,"blksize") == 0) {
                                TftpBlkSize = (unsigned short)
                                        simple_strtoul((char*)pkt+i+8,NULL,10);