diff options
| author | Santosh P K <sapk@vmware.com> | 2020-01-07 07:47:13 -0800 |
|---|---|---|
| committer | Donatas Abraitis <donatas.abraitis@gmail.com> | 2020-01-16 12:53:50 +0200 |
| commit | b74d522b7e378e0588876d38d61d32f8f99dc2c0 (patch) | |
| tree | 3eb89c41e119b2b18ed4cff3cb2960b5ea470028 | |
| parent | 206b53486b6aa4f4b245108521ae3097a833fc55 (diff) | |
bgpd: fix unaligned access to addpath id
uint8_t * cannot be cast to uint32_t * unless the
pointed-to address is aligned according to uint32_t's
alignment rules. And it usually is not.
Signed-off-by: Santosh P K <sapk@vmware.com>
| -rw-r--r-- | bgpd/bgp_evpn.c | 3 | ||||
| -rw-r--r-- | bgpd/bgp_label.c | 3 | ||||
| -rw-r--r-- | bgpd/bgp_mplsvpn.c | 3 | ||||
| -rw-r--r-- | bgpd/bgp_route.c | 2 |
4 files changed, 7 insertions, 4 deletions
diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c index 4d02e39ae2..739f8e605f 100644 --- a/bgpd/bgp_evpn.c +++ b/bgpd/bgp_evpn.c @@ -4925,7 +4925,8 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_label.c b/bgpd/bgp_label.c index 489ac6ea9f..ff1ab1a37d 100644 --- a/bgpd/bgp_label.c +++ b/bgpd/bgp_label.c @@ -368,7 +368,8 @@ int bgp_nlri_parse_label(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_mplsvpn.c b/bgpd/bgp_mplsvpn.c index e8d3062561..3ad41ca620 100644 --- a/bgpd/bgp_mplsvpn.c +++ b/bgpd/bgp_mplsvpn.c @@ -142,7 +142,8 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c index d7f7fb0112..ea451f5f8d 100644 --- a/bgpd/bgp_route.c +++ b/bgpd/bgp_route.c @@ -4468,7 +4468,7 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - memcpy(&addpath_id, pnt, 4); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } |