TFTP accepts a first response from an IP other than the requested server

Summary: When curl sends a TFTP request to the IP in the URL, it accepts the first valid response from any source IP and pins that sender as the transfer peer. A host that can get UDP packets to the client's ephemeral port and win this first-response race can receive bytes from a TFTP upload or …

if(state->remote_pinned) {
  if((state->remote_addrlen != fromlen) ||
     memcmp(&remote_addr, &state->remote_addr, fromlen))
    return CURLE_RECV_ERROR;
}
else {
  state->remote_pinned = TRUE;
  state->remote_addrlen = fromlen;
  memcpy(&state->remote_addr, &remote_addr, fromlen);
}