Check for correct block number in tftp_rx_data().

(Problem observed by Clay McClure in VMware Fusion.)

diff --git a/src/net/udp/tftp.c b/src/net/udp/tftp.c
index 74c8c0a..194c533 100644 (file)
--- a/src/net/udp/tftp.c
+++ b/src/net/udp/tftp.c
@@ -415,7 +415,7 @@ static int tftp_rx_oack ( struct tftp_request *tftp, void *buf, size_t len ) {
 static int tftp_rx_data ( struct tftp_request *tftp,
                          struct io_buffer *iobuf ) {
        struct tftp_data *data = iobuf->data;
-       unsigned int block;
+       int block;
        size_t data_len;
        int rc;
 
@@ -432,6 +432,14 @@ static int tftp_rx_data ( struct tftp_request *tftp,
        iob_pull ( iobuf, sizeof ( *data ) );
        data_len = iob_len ( iobuf );
 
+       /* Check for correct block */
+       if ( block != ( tftp->state + 1 ) ) {
+               DBGC ( tftp, "TFTP %p received out-of-order block %d "
+                      "(expecting %d)\n", tftp, block, ( tftp->state + 1 ) );
+               free_iob ( iobuf );
+               return 0;
+       }
+
        /* Deliver data */
        if ( ( rc = xfer_deliver_iob ( &tftp->xfer, iobuf ) ) != 0 ) {
                DBGC ( tftp, "TFTP %p could not deliver data: %s\n",