diff options
| author | Stefan Roese <sr@denx.de> | 2007-09-02 14:02:19 +0200 |
|---|---|---|
| committer | Stefan Roese <sr@denx.de> | 2007-09-02 14:02:19 +0200 |
| commit | 1d1ab638f8b5961e4972d29394e573afb39667be (patch) | |
| tree | 36fa9e8b01e05323e93a55a2cdc592fe69b5396c /net | |
| parent | 81b73dec16fd1227369a191e725e10044a9d56b8 (diff) | |
| parent | 60174746c668b309378a91488dded898e9553eae (diff) | |
| download | u-boot-imx-1d1ab638f8b5961e4972d29394e573afb39667be.zip u-boot-imx-1d1ab638f8b5961e4972d29394e573afb39667be.tar.gz u-boot-imx-1d1ab638f8b5961e4972d29394e573afb39667be.tar.bz2 | |
Merge with git://www.denx.de/git/u-boot.git
Diffstat (limited to 'net')
| -rw-r--r-- | net/tftp.c | 10 |
1 files changed, 7 insertions, 3 deletions
@@ -178,7 +178,7 @@ TftpSend (void) pkt += strlen((char *)pkt) + 1; /* try for more effic. blk size */ pkt += sprintf((char *)pkt,"blksize%c%d%c", - 0,htons(TftpBlkSizeOption),0); + 0,TftpBlkSizeOption,0); #ifdef CONFIG_MCAST_TFTP /* Check all preconditions before even trying the option */ if (!ProhibitMcast @@ -276,8 +276,12 @@ TftpHandler (uchar * pkt, unsigned dest, unsigned src, unsigned len) #endif TftpState = STATE_OACK; TftpServerPort = src; - /* Check for 'blksize' option */ - for (i=0;i<len-8;i++) { + /* + * Check for 'blksize' option. + * Careful: "i" is signed, "len" is unsigned, thus + * something like "len-8" may give a *huge* number + */ + for (i=0; i+8<len; i++) { if (strcmp ((char*)pkt+i,"blksize") == 0) { TftpBlkSize = (unsigned short) simple_strtoul((char*)pkt+i+8,NULL,10); |