linux-ext4 - [PATCH 08/38] lib/blkid: fix unaligned access to hfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 21 Jan 2023 12:32:00 -0800
From:   Eric Biggers <ebiggers@...nel.org>
To:     linux-ext4@...r.kernel.org
Subject: [PATCH 08/38] lib/blkid: fix unaligned access to hfs_mdb

From: Eric Biggers <ebiggers@...gle.com>

With -Wall, gcc warns:

      ./probe.c:1209:42: error: taking address of packed member of
               'struct hfs_mdb' may result in an unaligned pointer value

This seems to be a real unaligned memory access bug, as the offset of
the 64-bit value from the start of the buffer is 116, which is not a
multiple of 8.  Fix it by using memcpy().

Do the same for hfsplus to fix the same warning, though in that case the
offset is a multiple of 8 so it was defined behavior.

Signed-off-by: Eric Biggers <ebiggers@...gle.com>
---
 lib/blkid/probe.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/lib/blkid/probe.c b/lib/blkid/probe.c
index b8b6558e3..6a3bb2478 100644
--- a/lib/blkid/probe.c
+++ b/lib/blkid/probe.c
@@ -1198,7 +1198,6 @@ static int probe_hfs(struct blkid_probe *probe __BLKID_ATTR((unused)),
 			 unsigned char *buf)
 {
 	struct hfs_mdb *hfs = (struct hfs_mdb *)buf;
-	unsigned long long *uuid_ptr;
 	char	uuid_str[17];
 	__u64	uuid;
 
@@ -1206,8 +1205,8 @@ static int probe_hfs(struct blkid_probe *probe __BLKID_ATTR((unused)),
 	    (memcmp(hfs->embed_sig, "HX", 2) == 0))
 		return 1;	/* Not hfs, but an embedded HFS+ */
 
-	uuid_ptr = (unsigned long long *)hfs->finder_info.id;
-	uuid = blkid_le64(*uuid_ptr);
+	memcpy(&uuid, hfs->finder_info.id, 8);
+	uuid = blkid_le64(uuid);
 	if (uuid) {
 		sprintf(uuid_str, "%016llX", uuid);
 		blkid_set_tag(probe->dev, "UUID", uuid_str, 0);
@@ -1243,7 +1242,6 @@ static int probe_hfsplus(struct blkid_probe *probe,
 	unsigned int leaf_node_size;
 	unsigned int leaf_block;
 	unsigned int label_len;
-	unsigned long long *uuid_ptr;
 	__u64 leaf_off, uuid;
 	char	uuid_str[17], label[512];
 	int ext;
@@ -1274,8 +1272,8 @@ static int probe_hfsplus(struct blkid_probe *probe,
 	    (memcmp(hfsplus->signature, "HX", 2) != 0))
 		return 1;
 
-	uuid_ptr = (unsigned long long *)hfsplus->finder_info.id;
-	uuid = blkid_le64(*uuid_ptr);
+	memcpy(&uuid, hfsplus->finder_info.id, 8);
+	uuid = blkid_le64(uuid);
 	if (uuid) {
 		sprintf(uuid_str, "%016llX", uuid);
 		blkid_set_tag(probe->dev, "UUID", uuid_str, 0);
-- 
2.39.0