<p>Stefan Sperling has uploaded this change for <strong>review</strong>.</p><p><a href="https://gerrit.osmocom.org/10027">View Change</a></p><pre style="font-family: monospace,monospace; white-space: pre-wrap;">fix unaligned access in build_ipcp_pco()<br><br>Copy a struct ipcp_hdr to the stack, where it will be appropriately<br>aligned by the compiler, rather than accessing the data through a<br>potentially misaligned pointer.<br><br>Change-Id: Ifc1a2b623dee99ecf188df14a0808fe8219a98bf<br>Related: OS#3194<br>---<br>M ggsn/ggsn.c<br>1 file changed, 7 insertions(+), 5 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://gerrit.osmocom.org:29418/osmo-ggsn refs/changes/27/10027/1</pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/ggsn/ggsn.c b/ggsn/ggsn.c</span><br><span>index 6d879c0..8e0e934 100644</span><br><span>--- a/ggsn/ggsn.c</span><br><span>+++ b/ggsn/ggsn.c</span><br><span>@@ -504,31 +504,33 @@</span><br><span> {</span><br><span>      const struct in46_addr *dns1 = &apn->v4.cfg.dns[0];</span><br><span>   const struct in46_addr *dns2 = &apn->v4.cfg.dns[1];</span><br><span style="color: hsl(0, 100%, 40%);">-      struct ipcp_hdr *ipcp;</span><br><span style="color: hsl(120, 100%, 40%);">+        struct ipcp_hdr ipcp;</span><br><span>        uint8_t *len1, *len2, *pco_ipcp;</span><br><span>     uint8_t *start = msg->tail;</span><br><span>       unsigned int len_appended;</span><br><span> </span><br><span>       if (!(pco_ipcp = pco_contains_proto(&pdp->pco_req, PCO_P_IPCP)))</span><br><span>              return 0;</span><br><span style="color: hsl(0, 100%, 40%);">-       ipcp = (struct ipcp_hdr*) (pco_ipcp + 3);  /* 2=type + 1=len */</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+     /* Copy to stack avoids unaligned access on some platforms. */</span><br><span style="color: hsl(120, 100%, 40%);">+        memcpy(&ipcp, pco_ipcp + 3, sizeof(ipcp)); /* 2=type + 1=len */</span><br><span> </span><br><span>      /* Three byte T16L header */</span><br><span>         msgb_put_u16(msg, 0x8021);      /* IPCP */</span><br><span>   len1 = msgb_put(msg, 1);        /* Length of contents: delay */</span><br><span> </span><br><span>  msgb_put_u8(msg, 0x02);         /* ACK */</span><br><span style="color: hsl(0, 100%, 40%);">-       msgb_put_u8(msg, ipcp->id);  /* ID: Needs to match request */</span><br><span style="color: hsl(120, 100%, 40%);">+      msgb_put_u8(msg, ipcp.id);      /* ID: Needs to match request */</span><br><span>     msgb_put_u8(msg, 0x00);         /* Length MSB */</span><br><span>     len2 = msgb_put(msg, 1);        /* Length LSB: delay */</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-     if (dns1->len == 4 && ipcp_contains_option(ipcp, IPCP_OPT_PRIMARY_DNS)) {</span><br><span style="color: hsl(120, 100%, 40%);">+  if (dns1->len == 4 && ipcp_contains_option(&ipcp, IPCP_OPT_PRIMARY_DNS)) {</span><br><span>            msgb_put_u8(msg, 0x81);         /* DNS1 Tag */</span><br><span>               msgb_put_u8(msg, 2 + dns1->len);/* DNS1 Length, incl. TL */</span><br><span>               msgb_put_u32(msg, ntohl(dns1->v4.s_addr));</span><br><span>        }</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-   if (dns2->len == 4 && ipcp_contains_option(ipcp, IPCP_OPT_SECONDARY_DNS)) {</span><br><span style="color: hsl(120, 100%, 40%);">+        if (dns2->len == 4 && ipcp_contains_option(&ipcp, IPCP_OPT_SECONDARY_DNS)) {</span><br><span>          msgb_put_u8(msg, 0x83);         /* DNS2 Tag */</span><br><span>               msgb_put_u8(msg, 2 + dns2->len);/* DNS2 Length, incl. TL */</span><br><span>               msgb_put_u32(msg, ntohl(dns2->v4.s_addr));</span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.osmocom.org/10027">change 10027</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.osmocom.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.osmocom.org/10027"/><meta itemprop="name" content="View Change"/></div></div>

<div style="display:none"> Gerrit-Project: osmo-ggsn </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-MessageType: newchange </div>
<div style="display:none"> Gerrit-Change-Id: Ifc1a2b623dee99ecf188df14a0808fe8219a98bf </div>
<div style="display:none"> Gerrit-Change-Number: 10027 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Stefan Sperling <ssperling@sysmocom.de> </div>