<p>Stefan Sperling has uploaded this change for <strong>review</strong>.</p><p><a href="https://gerrit.osmocom.org/10027">View Change</a></p><pre style="font-family: monospace,monospace; white-space: pre-wrap;">fix unaligned access in build_ipcp_pco()<br><br>Copy a struct ipcp_hdr to the stack, where it will be appropriately<br>aligned by the compiler, rather than accessing the data through a<br>potentially misaligned pointer.<br><br>Change-Id: Ifc1a2b623dee99ecf188df14a0808fe8219a98bf<br>Related: OS#3194<br>---<br>M ggsn/ggsn.c<br>1 file changed, 7 insertions(+), 5 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://gerrit.osmocom.org:29418/osmo-ggsn refs/changes/27/10027/1</pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/ggsn/ggsn.c b/ggsn/ggsn.c</span><br><span>index 6d879c0..8e0e934 100644</span><br><span>--- a/ggsn/ggsn.c</span><br><span>+++ b/ggsn/ggsn.c</span><br><span>@@ -504,31 +504,33 @@</span><br><span> {</span><br><span> const struct in46_addr *dns1 = &apn->v4.cfg.dns[0];</span><br><span> const struct in46_addr *dns2 = &apn->v4.cfg.dns[1];</span><br><span style="color: hsl(0, 100%, 40%);">- struct ipcp_hdr *ipcp;</span><br><span style="color: hsl(120, 100%, 40%);">+ struct ipcp_hdr ipcp;</span><br><span> uint8_t *len1, *len2, *pco_ipcp;</span><br><span> uint8_t *start = msg->tail;</span><br><span> unsigned int len_appended;</span><br><span> </span><br><span> if (!(pco_ipcp = pco_contains_proto(&pdp->pco_req, PCO_P_IPCP)))</span><br><span> return 0;</span><br><span style="color: hsl(0, 100%, 40%);">- ipcp = (struct ipcp_hdr*) (pco_ipcp + 3); /* 2=type + 1=len */</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ /* Copy to stack avoids unaligned access on some platforms. */</span><br><span style="color: hsl(120, 100%, 40%);">+ memcpy(&ipcp, pco_ipcp + 3, sizeof(ipcp)); /* 2=type + 1=len */</span><br><span> </span><br><span> /* Three byte T16L header */</span><br><span> msgb_put_u16(msg, 0x8021); /* IPCP */</span><br><span> len1 = msgb_put(msg, 1); /* Length of contents: delay */</span><br><span> </span><br><span> msgb_put_u8(msg, 0x02); /* ACK */</span><br><span style="color: hsl(0, 100%, 40%);">- msgb_put_u8(msg, ipcp->id); /* ID: Needs to match request */</span><br><span style="color: hsl(120, 100%, 40%);">+ msgb_put_u8(msg, ipcp.id); /* ID: Needs to match request */</span><br><span> msgb_put_u8(msg, 0x00); /* Length MSB */</span><br><span> len2 = msgb_put(msg, 1); /* Length LSB: delay */</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if (dns1->len == 4 && ipcp_contains_option(ipcp, IPCP_OPT_PRIMARY_DNS)) {</span><br><span style="color: hsl(120, 100%, 40%);">+ if (dns1->len == 4 && ipcp_contains_option(&ipcp, IPCP_OPT_PRIMARY_DNS)) {</span><br><span> msgb_put_u8(msg, 0x81); /* DNS1 Tag */</span><br><span> msgb_put_u8(msg, 2 + dns1->len);/* DNS1 Length, incl. TL */</span><br><span> msgb_put_u32(msg, ntohl(dns1->v4.s_addr));</span><br><span> }</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if (dns2->len == 4 && ipcp_contains_option(ipcp, IPCP_OPT_SECONDARY_DNS)) {</span><br><span style="color: hsl(120, 100%, 40%);">+ if (dns2->len == 4 && ipcp_contains_option(&ipcp, IPCP_OPT_SECONDARY_DNS)) {</span><br><span> msgb_put_u8(msg, 0x83); /* DNS2 Tag */</span><br><span> msgb_put_u8(msg, 2 + dns2->len);/* DNS2 Length, incl. TL */</span><br><span> msgb_put_u32(msg, ntohl(dns2->v4.s_addr));</span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.osmocom.org/10027">change 10027</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.osmocom.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.osmocom.org/10027"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: osmo-ggsn </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-MessageType: newchange </div>
<div style="display:none"> Gerrit-Change-Id: Ifc1a2b623dee99ecf188df14a0808fe8219a98bf </div>
<div style="display:none"> Gerrit-Change-Number: 10027 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Stefan Sperling <ssperling@sysmocom.de> </div>