From a90300110f42b1b3091093ec87eef56c9e644c05 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Fri, 3 May 2019 22:20:37 +0200 Subject: [PATCH] tftp: use the current blksize for recvfrom() bug: https://curl.haxx.se/docs/CVE-2019-5436.html Reported-by: l00p3r on hackerone CVE-2019-5436 Backported patch link: https://github.com/curl/curl/commit/2576003415625d7b5f0e390902f8097830b82275.patch Change-Id: Ic6093d1d475ed9ba87e41cff315befdc3aca9c1d Signed-off-by: Nishant Chaprana --- lib/tftp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/tftp.c b/lib/tftp.c index 5b74e8e..479e847 100644 --- a/lib/tftp.c +++ b/lib/tftp.c @@ -1005,7 +1005,7 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done) state->sockfd = state->conn->sock[FIRSTSOCKET]; state->state = TFTP_STATE_START; state->error = TFTP_ERR_NONE; - state->blksize = TFTP_BLKSIZE_DEFAULT; + state->blksize = blksize; state->requested_blksize = blksize; ((struct sockaddr *)&state->local_addr)->sa_family = -- 2.7.4