A flaw was found in BusyBox's tftp client. When the server's first reply to a read or write request is not an OACK packet, the client falls back to the default block size of 512 bytes without reallocating the packet buffers, which were allocated for the smaller block size requested with the -b option. A malicious tftp server can exploit this by sending a 516-byte datagram that is stored into the undersized heap buffer; on upload, 512 bytes of the local file are read into the undersized buffer. Processing a crafted tftp transfer may cause the client to crash or potentially execute arbitrary code.