slirp: tftp: Relax filename format check

[ Applies on top of my recently posted slirp series. ]

Allow tftp requests with filenames that do not start with a slash.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/tftp.c b/tftp.c
index 59fc91d..838176b 100644
--- a/tftp.c
+++ b/tftp.c
@@ -283,11 +283,12 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
 
     /* prepend tftp_prefix */
     prefix_len = strlen(slirp->tftp_prefix);
-    spt->filename = qemu_malloc(prefix_len + TFTP_FILENAME_MAX + 1);
+    spt->filename = qemu_malloc(prefix_len + TFTP_FILENAME_MAX + 2);
     memcpy(spt->filename, slirp->tftp_prefix, prefix_len);
+    spt->filename[prefix_len] = '/';
 
     /* get name */
-    req_fname = spt->filename + prefix_len;
+    req_fname = spt->filename + prefix_len + 1;
 
     while (1) {
         if (k >= TFTP_FILENAME_MAX || k >= pktlen) {
@@ -314,8 +315,8 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
     k += 6; /* skipping octet */
 
     /* do sanity checks on the filename */
-    if (req_fname[0] != '/' || req_fname[strlen(req_fname) - 1] == '/' ||
-        strstr(req_fname, "/../")) {
+    if (!strncmp(req_fname, "../", 3) ||
+        req_fname[strlen(req_fname) - 1] == '/' || strstr(req_fname, "/../")) {
         tftp_send_error(spt, 2, "Access violation", tp);
         return;
     }