root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

bss_dgram.c: fix unaligned access 

char (alignment 1) casted to union sctp_notification (alignment > 1).

Fixes: #9538

Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10336)
This commit is contained in:
Patrick Steuer 2019-11-02 16:31:28 +01:00
parent fd4a6e7d1e
commit 287e1a7eac
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
crypto/bio/bss_dgram.c
View File

@ -1009,7 +1009,6 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
int ret = 0, n = 0, i, optval; int ret = 0, n = 0, i, optval;
socklen_t optlen; socklen_t optlen;
bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr; bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr;
union sctp_notification *snp;
struct msghdr msg; struct msghdr msg;
struct iovec iov; struct iovec iov;
struct cmsghdr *cmsg; struct cmsghdr *cmsg;
@ -1075,8 +1074,10 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
} }
if (msg.msg_flags & MSG_NOTIFICATION) { if (msg.msg_flags & MSG_NOTIFICATION) {
snp = (union sctp_notification *)out; union sctp_notification snp;
if (snp->sn_header.sn_type == SCTP_SENDER_DRY_EVENT) {
memcpy(&snp, out, sizeof(snp));
if (snp.sn_header.sn_type == SCTP_SENDER_DRY_EVENT) {
# ifdef SCTP_EVENT # ifdef SCTP_EVENT
struct sctp_event event; struct sctp_event event;
# else # else
@ -1116,17 +1117,19 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
# endif # endif
} }
# ifdef SCTP_AUTHENTICATION_EVENT # ifdef SCTP_AUTHENTICATION_EVENT
if (snp->sn_header.sn_type == SCTP_AUTHENTICATION_EVENT) if (snp.sn_header.sn_type == SCTP_AUTHENTICATION_EVENT)
dgram_sctp_handle_auth_free_key_event(b, snp); dgram_sctp_handle_auth_free_key_event(b, &snp);
# endif # endif
if (data->handle_notifications != NULL) if (data->handle_notifications != NULL)
data->handle_notifications(b, data->notification_context, data->handle_notifications(b, data->notification_context,
(void *)out); (void *)out);
memset(&snp, 0, sizeof(snp));
memset(out, 0, outl); memset(out, 0, outl);
} else } else {
ret += n; ret += n;
}
} }
while ((msg.msg_flags & MSG_NOTIFICATION) && (msg.msg_flags & MSG_EOR) while ((msg.msg_flags & MSG_NOTIFICATION) && (msg.msg_flags & MSG_EOR)
&& (ret < outl)); && (ret < outl));