From b74d522b7e378e0588876d38d61d32f8f99dc2c0 Mon Sep 17 00:00:00 2001 From: Santosh P K Date: Tue, 7 Jan 2020 07:47:13 -0800 Subject: [PATCH] bgpd: fix unaligned access to addpath id uint8_t * cannot be cast to uint32_t * unless the pointed-to address is aligned according to uint32_t's alignment rules. And it usually is not. Signed-off-by: Santosh P K --- bgpd/bgp_evpn.c | 3 ++- bgpd/bgp_label.c | 3 ++- bgpd/bgp_mplsvpn.c | 3 ++- bgpd/bgp_route.c | 2 +- 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c index 4d02e39ae2..739f8e605f 100644 --- a/bgpd/bgp_evpn.c +++ b/bgpd/bgp_evpn.c @@ -4925,7 +4925,8 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_label.c b/bgpd/bgp_label.c index 489ac6ea9f..ff1ab1a37d 100644 --- a/bgpd/bgp_label.c +++ b/bgpd/bgp_label.c @@ -368,7 +368,8 @@ int bgp_nlri_parse_label(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_mplsvpn.c b/bgpd/bgp_mplsvpn.c index e8d3062561..3ad41ca620 100644 --- a/bgpd/bgp_mplsvpn.c +++ b/bgpd/bgp_mplsvpn.c @@ -142,7 +142,8 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c index d7f7fb0112..ea451f5f8d 100644 --- a/bgpd/bgp_route.c +++ b/bgpd/bgp_route.c @@ -4468,7 +4468,7 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - memcpy(&addpath_id, pnt, 4); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } -- 2.39.5