Guillaume Tucker authored Sep 03, 2018 and Ricardo Cañuelo committed Oct 20, 2020

The TFTP protocol defines a 16-bit block number, which will typically
wrap around by server implementations to allow files with more than
65535 blocks.  As each block typically has a size of 512 bytes, the
overflow happens after 32 MiB of data being transferred.

The sequence of block numbers is being verified in tftp.c to ensure
the blocks are received in the correct order.  While most FIT images
will be smaller than 32MiB, it's easy to go beyond this limit with
debug kernel configs enabled and when using ramdisks.

To cope with this, only check the block number sequence within the
16-bit integer range.  With TFTP servers able to deliver any file size
by wrapping the block number around, this allows any file size to be
downloaded.

BRANCH=master
BUG=none
TEST=Boot with FIT image larger than 32MiB

Change-Id: Icfe988cc33747528493bf37d8e56d2df34a46a81
Signed-off-by: Guillaume Tucker <guillaume.tucker@collabora.com>
Reviewed-on: https://chromium-review.googlesource.com/1202122


Commit-Ready: Guillaume Tucker <gtucker.collabora@gmail.com>
Tested-by: Guillaume Tucker <gtucker.collabora@gmail.com>
Reviewed-by: Julius Werner <jwerner@chromium.org>