diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-09-07 20:54:47 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-09-07 20:54:47 +0300 |
| commit | 7e81fd4a4c5fb47f9ddfc6d99124ade83ca58940 (patch) | |
| tree | ee978a149543f91c8a155a6f6dcbee26564f7bf5 /accel-pppd/extra | |
| parent | 57ae56148c5519b9207ede623098d3cfad5211b8 (diff) | |
| parent | 4654c4a9c083780f5e151ee064e69a357c48d364 (diff) | |
| download | accel-ppp-7e81fd4a4c5fb47f9ddfc6d99124ade83ca58940.tar.gz accel-ppp-7e81fd4a4c5fb47f9ddfc6d99124ade83ca58940.zip | |
Merge pull request #361 from nuclearcat/fix-protocol-buffer-access
Fix several unsafe or unaligned integer accesses found in protocol parsing paths, including option-gated MPPE, DHCP, PPPoE, RADIUS, IPCP and IPv6CP code.
Diffstat (limited to 'accel-pppd/extra')
| -rw-r--r-- | accel-pppd/extra/ippool.c | 4 | ||||
| -rw-r--r-- | accel-pppd/extra/ipv6pool.c | 13 |
2 files changed, 12 insertions, 5 deletions
diff --git a/accel-pppd/extra/ippool.c b/accel-pppd/extra/ippool.c index e935bb4c..28aecd95 100644 --- a/accel-pppd/extra/ippool.c +++ b/accel-pppd/extra/ippool.c @@ -736,10 +736,10 @@ static int session_restore(struct ap_session *ses, struct backup_mod *m) list_for_each_entry(tag, &m->tag_list, entry) { switch (tag->id) { case SES_TAG_IPV4_ADDR: - addr = *(in_addr_t *)tag->data; + memcpy(&addr, tag->data, sizeof(addr)); break; case SES_TAG_IPV4_PEER_ADDR: - peer_addr = *(in_addr_t *)tag->data; + memcpy(&peer_addr, tag->data, sizeof(peer_addr)); break; } } diff --git a/accel-pppd/extra/ipv6pool.c b/accel-pppd/extra/ipv6pool.c index 9a763445..05b84fe8 100644 --- a/accel-pppd/extra/ipv6pool.c +++ b/accel-pppd/extra/ipv6pool.c @@ -293,11 +293,18 @@ static void add_prefix(struct ip6_pool *pool, const char *_val) /* end = start | hostmask(mask) (matches the original generator) */ memcpy(&end, &start, sizeof(end)); - if (mask > 64) - *(uint64_t *)(end.s6_addr + 8) = htobe64(be64toh(*(uint64_t *)(end.s6_addr + 8)) | ((1llu << (128 - mask)) - 1)); + if (mask > 64) { + uint64_t value; + memcpy(&value, end.s6_addr + 8, sizeof(value)); + value = htobe64(be64toh(value) | ((1llu << (128 - mask)) - 1)); + memcpy(end.s6_addr + 8, &value, sizeof(value)); + } else { + uint64_t value; memset(end.s6_addr + 8, 0xff, 8); - *(uint64_t *)end.s6_addr = htobe64(be64toh(*(uint64_t *)end.s6_addr) | ((1llu << (64 - mask)) - 1)); + memcpy(&value, end.s6_addr, sizeof(value)); + value = htobe64(be64toh(value) | ((1llu << (64 - mask)) - 1)); + memcpy(end.s6_addr, &value, sizeof(value)); } { |