diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-09-07 20:54:47 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-09-07 20:54:47 +0300 |
| commit | 7e81fd4a4c5fb47f9ddfc6d99124ade83ca58940 (patch) | |
| tree | ee978a149543f91c8a155a6f6dcbee26564f7bf5 /accel-pppd/extra/ipv6pool.c | |
| parent | 57ae56148c5519b9207ede623098d3cfad5211b8 (diff) | |
| parent | 4654c4a9c083780f5e151ee064e69a357c48d364 (diff) | |
| download | accel-ppp-7e81fd4a4c5fb47f9ddfc6d99124ade83ca58940.tar.gz accel-ppp-7e81fd4a4c5fb47f9ddfc6d99124ade83ca58940.zip | |
Merge pull request #361 from nuclearcat/fix-protocol-buffer-access
Fix several unsafe or unaligned integer accesses found in protocol parsing paths, including option-gated MPPE, DHCP, PPPoE, RADIUS, IPCP and IPv6CP code.
Diffstat (limited to 'accel-pppd/extra/ipv6pool.c')
| -rw-r--r-- | accel-pppd/extra/ipv6pool.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/accel-pppd/extra/ipv6pool.c b/accel-pppd/extra/ipv6pool.c index 9a763445..05b84fe8 100644 --- a/accel-pppd/extra/ipv6pool.c +++ b/accel-pppd/extra/ipv6pool.c @@ -293,11 +293,18 @@ static void add_prefix(struct ip6_pool *pool, const char *_val) /* end = start | hostmask(mask) (matches the original generator) */ memcpy(&end, &start, sizeof(end)); - if (mask > 64) - *(uint64_t *)(end.s6_addr + 8) = htobe64(be64toh(*(uint64_t *)(end.s6_addr + 8)) | ((1llu << (128 - mask)) - 1)); + if (mask > 64) { + uint64_t value; + memcpy(&value, end.s6_addr + 8, sizeof(value)); + value = htobe64(be64toh(value) | ((1llu << (128 - mask)) - 1)); + memcpy(end.s6_addr + 8, &value, sizeof(value)); + } else { + uint64_t value; memset(end.s6_addr + 8, 0xff, 8); - *(uint64_t *)end.s6_addr = htobe64(be64toh(*(uint64_t *)end.s6_addr) | ((1llu << (64 - mask)) - 1)); + memcpy(&value, end.s6_addr, sizeof(value)); + value = htobe64(be64toh(value) | ((1llu << (64 - mask)) - 1)); + memcpy(end.s6_addr, &value, sizeof(value)); } { |