On Wed, Jan 14, 2026 at 03:12:09PM +0000, Andrew Goodbody wrote:
> sprintf will add a trailing \0 so manually adding a trailing \0 will
> result in an extra unaccounted for character being written. This
> overwrote the first byte of the following allocation block resulting in
> unexpected behavior.
>
> This was found by Running 'pxe get' with no available file resulting in
> multiple attempts, using the default algorithm, to attempt to find a file.
> Eventually there would be a failed assert when free() was called.
> Failing the assert would result in a system reset.
>
> Fixes: 27d7ccda94fa ("net: lwip: tftp: add support of blksize option to
> client")
> Reported-by: Michal Simek <[email protected]>
> Tested-by: Michal Simek <[email protected]>
>
> Signed-off-by: Andrew Goodbody <[email protected]>Tested-by: Tom Rini <[email protected]> # Pine64+ -- Tom
signature.asc
Description: PGP signature
