The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) an

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than

four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not

against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one

missing check, both reachable before any authentication because TFTP has none.

The handler passes nx_packet_length - 4 straight to FileX:

 1 
 2 
 3 
 4/* addons/tftp/nxd_tftp_server.c:1863, 1889 */
 5 
 6 
 7 
 8status = nx_packet_copy(packet_ptr, &temp_ptr,
 9 
10                        server_ptr -> nx_tftp_server_packet_pool_ptr, NX_WAIT_FOREVER);
11 
12 
13...
14 
15 
16 
17fx_file_write(&(client_request_ptr -> nx_tftp_client_request_file),
18 
19              packet_ptr -> nx_packet_prepend_ptr + 4,
20              packet_ptr -> nx_packet_length - 4);
21 

nx_packet_length is the length of a chain, not of one contiguous buffer, so FileX copies past the

end of the first packet:

 1 
 2 
 3 
 4ERROR: AddressSanitizer: heap-buffer-overflow
 5 
 6 
 7 
 8READ of size 1280 at 0x621000001108 thread T5
 9 
10    #0 __interceptor_memcpy
11    #1 _fx_utility_memory_copy  filex/common/src/fx_utility_memory_copy.c:78
12 
13 
140x621000001108 is 0 bytes to the right of 4104-byte region
15 
16 

Those bytes are written into the file the attacker is uploading, and a TFTP read request hands them

back, so this is a memory disclosure with a convenient retrieval channel.

The same datagram also wedges the server. nx_packet_copy at :1863 needs

ceil(nx_packet_length / pool_payload) packets and asks for them with NX_WAIT_FOREVER, so when the

attacker sizes the datagram beyond what the pool holds, the server thread suspends and never

returns. A liveness probe after one such datagram times out with the pool at 0 of 12 packets and

the server thread suspended, and no later client is served.

Reject nx_packet_length > 4 + NX_TFTP_FILE_TRANSFER_MAX in the DATA branch before either call,

and use a bounded wait rather than NX_WAIT_FOREVER for the copy.