From a3a850a17df1705211cc908ee69382d60bb4cdff Mon Sep 17 00:00:00 2001 From: Santosh P K Date: Tue, 7 Jan 2020 07:47:13 -0800 Subject: [PATCH] bgpd: fix unaligned access to addpath id uint8_t * cannot be cast to uint32_t * unless the pointed-to address is aligned according to uint32_t's alignment rules. And it usually is not. Signed-off-by: Santosh P K --- bgpd/bgp_evpn.c | 3 ++- bgpd/bgp_label.c | 3 ++- bgpd/bgp_mplsvpn.c | 3 ++- bgpd/bgp_route.c | 2 +- 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c index b8798a7ced..79a8fae530 100644 --- a/bgpd/bgp_evpn.c +++ b/bgpd/bgp_evpn.c @@ -5100,7 +5100,8 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_label.c b/bgpd/bgp_label.c index 489ac6ea9f..ff1ab1a37d 100644 --- a/bgpd/bgp_label.c +++ b/bgpd/bgp_label.c @@ -368,7 +368,8 @@ int bgp_nlri_parse_label(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_mplsvpn.c b/bgpd/bgp_mplsvpn.c index 59ed433e58..86c04b71f0 100644 --- a/bgpd/bgp_mplsvpn.c +++ b/bgpd/bgp_mplsvpn.c @@ -142,7 +142,8 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN > lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - addpath_id = ntohl(*((uint32_t *)pnt)); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); + addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; } diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c index b216f85c40..5f4486b800 100644 --- a/bgpd/bgp_route.c +++ b/bgpd/bgp_route.c @@ -4515,7 +4515,7 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr, if (pnt + BGP_ADDPATH_ID_LEN >= lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; - memcpy(&addpath_id, pnt, 4); + memcpy(&addpath_id, pnt, BGP_ADDPATH_ID_LEN); addpath_id = ntohl(addpath_id); pnt += BGP_ADDPATH_ID_LEN; }