Merge pull request #361 from nuclearcat/fix-protocol-buffer-access

Fix several unsafe or unaligned integer accesses found in protocol parsing paths, including option-gated MPPE, DHCP, PPPoE, RADIUS, IPCP and IPv6CP code.

1 files changed, 5 insertions, 3 deletions

diff --git a/accel-pppd/backup/backup_file.c b/accel-pppd/backup/backup_file.c
index 472694f0..eaaf87d2 100644
--- a/accel-pppd/backup/backup_file.c
+++ b/accel-pppd/backup/backup_file.c
@@ -96,7 +96,7 @@ static int fs_commit(struct backup_data *d)
 			ptr = (uint8_t *)(tag + 1);
 			*ptr = tag->id; ptr++;
 			*ptr = tag->internal ? 1 : 0; ptr++;
-			*(uint16_t *)ptr = tag->size;
+			memcpy(ptr, &tag->size, sizeof(tag->size));
 			MD5_Update(&md5, tag + 1, 4 + tag->size);
 			iov[i].iov_base = tag + 1;
 			iov[i].iov_len = 4 + tag->size;
@@ -278,14 +278,16 @@ static void restore_session(const char *fn, int internal)
 			}
 
 			if (!internal && ptr[1]) {
-				ptr += 4 + *(uint16_t *)(ptr + 2);
+				uint16_t tag_size;
+				memcpy(&tag_size, ptr + 2, sizeof(tag_size));
+				ptr += 4 + tag_size;
 				continue;
 			}
 
 			tag = fs_alloc_tag(d, 0);
 			tag->id = *ptr; ptr++;
 			tag->internal = (*ptr & 0x01) ? 1 : 0; ptr ++;
-			tag->size = *(uint16_t *)ptr; ptr += 2;
+			memcpy(&tag->size, ptr, sizeof(tag->size)); ptr += 2;
 			tag->data = ptr; ptr += tag->size;
 
 			list_add_tail(&tag->entry, &mod->tag_list);