From 5c89b6583079cd4cccbdf59929fa14515397430a Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Fri, 3 May 2019 22:20:37 +0200 Subject: [PATCH] tftp: use the current blksize for recvfrom() bug: CVE-2019-XXXXX Reported-by: l00p3r --- lib/tftp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: curl-7.64.0/lib/tftp.c =================================================================== --- curl-7.64.0.orig/lib/tftp.c 2019-05-16 08:35:01.353786616 -0400 +++ curl-7.64.0/lib/tftp.c 2019-05-16 08:35:01.353786616 -0400 @@ -1005,7 +1005,7 @@ static CURLcode tftp_connect(struct conn state->sockfd = state->conn->sock[FIRSTSOCKET]; state->state = TFTP_STATE_START; state->error = TFTP_ERR_NONE; - state->blksize = TFTP_BLKSIZE_DEFAULT; + state->blksize = blksize; state->requested_blksize = blksize; ((struct sockaddr *)&state->local_addr)->sa_family =