File curl-CVE-2019-5436.patch of Package curl.15477
From 5c89b6583079cd4cccbdf59929fa14515397430a Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 3 May 2019 22:20:37 +0200
Subject: [PATCH] tftp: use the current blksize for recvfrom()
bug: CVE-2019-XXXXX
Reported-by: l00p3r
---
lib/tftp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/tftp.c b/lib/tftp.c
index 8b92b7bd6..289cda282 100644
--- a/lib/tftp.c
+++ b/lib/tftp.c
@@ -1007,11 +1007,11 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done)
state->conn = conn;
state->sockfd = state->conn->sock[FIRSTSOCKET];
state->state = TFTP_STATE_START;
state->error = TFTP_ERR_NONE;
- state->blksize = TFTP_BLKSIZE_DEFAULT;
+ state->blksize = blksize;
state->requested_blksize = blksize;
((struct sockaddr *)&state->local_addr)->sa_family =
(CURL_SA_FAMILY_T)(conn->ip_addr->ai_family);
--
2.20.1