[bug-inetutils] Bug in tftpd (in multiple revisions including 1.7), causing tftpd to hang for ever

[Hugo Heutinck]

Dear Sir/Madam,

 

I believe I have detected and a bug in the inetutils tftpd daemon,

causing a tftpd daemon to hang forever if no ACK is received.

 

In the code, the setjmp and longjmp calls are used, to go into timeout

and resend the data again, when an acknowledge message is not received after sending data.

 

However on my target system (powerpc8555 running inetutils-1.4.2), some of the

tftpd daemons hang because of missing ACK's. And are not killed after 25 seconds

as should have been done by the code.

 

 

It seems to go through the timeout function once, but then never make it out

of the recv (that was waiting for ACK) again. Causing the daemon to hang forever

waiting for data it will never get (the client board requesting a file, sent a new RRQ

for the same file)

 

So something went wrong with the alarm not timing-out again.

 

Replacing all longjmp's with siglongjmp's, and all setjmp with

sigsetjmp (and adding SIGALRM as the 2nd argument), fixed this "hanging tftpd issue"

 

(lines 437: longjmp, line 464: setjmp, 529: setjmp)

 

With kind regards,

 

H.Heutinck