diff options
| author | Patrick Steuer <patrick.steuer@de.ibm.com> | 2019-11-02 16:31:28 +0100 |
|---|---|---|
| committer | Patrick Steuer <patrick.steuer@de.ibm.com> | 2019-11-10 00:30:13 +0100 |
| commit | 287e1a7eac1330f0e0e4fc443f9f762835246e9e (patch) | |
| tree | 3c5b26f7545f5f57f43960027ca25bacbede3427 | |
| parent | fd4a6e7d1e51ad53f70ae75317da36418cae6458 (diff) | |
bss_dgram.c: fix unaligned access
char (alignment 1) casted to union sctp_notification (alignment > 1).
Fixes: #9538
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10336)
| -rw-r--r-- | crypto/bio/bss_dgram.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c index ff961450dd..fc17c9ed4d 100644 --- a/crypto/bio/bss_dgram.c +++ b/crypto/bio/bss_dgram.c @@ -1009,7 +1009,6 @@ static int dgram_sctp_read(BIO *b, char *out, int outl) int ret = 0, n = 0, i, optval; socklen_t optlen; bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr; - union sctp_notification *snp; struct msghdr msg; struct iovec iov; struct cmsghdr *cmsg; @@ -1075,8 +1074,10 @@ static int dgram_sctp_read(BIO *b, char *out, int outl) } if (msg.msg_flags & MSG_NOTIFICATION) { - snp = (union sctp_notification *)out; - if (snp->sn_header.sn_type == SCTP_SENDER_DRY_EVENT) { + union sctp_notification snp; + + memcpy(&snp, out, sizeof(snp)); + if (snp.sn_header.sn_type == SCTP_SENDER_DRY_EVENT) { # ifdef SCTP_EVENT struct sctp_event event; # else @@ -1116,17 +1117,19 @@ static int dgram_sctp_read(BIO *b, char *out, int outl) # endif } # ifdef SCTP_AUTHENTICATION_EVENT - if (snp->sn_header.sn_type == SCTP_AUTHENTICATION_EVENT) - dgram_sctp_handle_auth_free_key_event(b, snp); + if (snp.sn_header.sn_type == SCTP_AUTHENTICATION_EVENT) + dgram_sctp_handle_auth_free_key_event(b, &snp); # endif if (data->handle_notifications != NULL) data->handle_notifications(b, data->notification_context, (void *)out); + memset(&snp, 0, sizeof(snp)); memset(out, 0, outl); - } else + } else { ret += n; + } } while ((msg.msg_flags & MSG_NOTIFICATION) && (msg.msg_flags & MSG_EOR) && (ret < outl)); |