From 004ec5adc7e5702c518583caef437d304932beb5 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Tue, 1 Sep 2026 08:50:35 +0300 Subject: ipv6: avoid integer access through address bytes Copy interface IDs and prefix words between aligned temporaries and byte arrays instead of casting IPv6 address storage to uint64_t pointers. --- accel-pppd/ipdb.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'accel-pppd/ipdb.c') diff --git a/accel-pppd/ipdb.c b/accel-pppd/ipdb.c index 8fc08063..264f67b3 100644 --- a/accel-pppd/ipdb.c +++ b/accel-pppd/ipdb.c @@ -75,18 +75,23 @@ void __export ipdb_put_ipv6_prefix(struct ap_session *ses, struct ipv6db_prefix_ void __export build_ip6_addr(struct ipv6db_addr_t *a, uint64_t intf_id, struct in6_addr *addr) { + uint64_t value; + memcpy(addr, &a->addr, sizeof(*addr)); if (a->prefix_len == 128) return; if (a->prefix_len <= 64) - *(uint64_t *)(addr->s6_addr + 8) = intf_id; - else + memcpy(addr->s6_addr + 8, &intf_id, sizeof(intf_id)); + else { /* prefix_len 65..127 means a shift of up to 63 bits: a plain * int literal 1 is undefined behavior for shifts >= 31, so the * host bits mask must be built from a 64-bit constant */ - *(uint64_t *)(addr->s6_addr + 8) |= intf_id & htobe64((UINT64_C(1) << (128 - a->prefix_len)) - 1); + memcpy(&value, addr->s6_addr + 8, sizeof(value)); + value |= intf_id & htobe64((UINT64_C(1) << (128 - a->prefix_len)) - 1); + memcpy(addr->s6_addr + 8, &value, sizeof(value)); + } } -- cgit v1.2.3