From: Jan Kiszka <jan.kis...@siemens.com>
Revealed by newer compilers and running the tools tests: The 32 and 64
bit fields in a uservar struct may end up being misaligned in memory,
and that can cause crashes (SIGBUS) on sensitive architectures,
specifically ARM. Avoid assumptions about natural alignments and
retrieve such fields via memcpy.
Signed-off-by: Jan Kiszka <jan.kis...@siemens.com>
---
env/uservars.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/env/uservars.c b/env/uservars.c
index a65701a..23c6350 100644
--- a/env/uservars.c
+++ b/env/uservars.c
@@ -51,13 +51,14 @@ void bgenv_map_uservar(uint8_t *udata, char **key, uint64_t
*type, uint8_t **val
/* Calculate the record size (size of the whole thing) */
if (record_size) {
- *record_size = *payload_size + strlen(var_key) + 1;
+ memcpy(record_size, payload_size, sizeof(*record_size));
+ *record_size += strlen(var_key) + 1;
}
/* Get position of the type field */
var_type = (uint64_t *)((uint8_t *)payload_size + sizeof(uint32_t));
if (type) {
- *type = *var_type;
+ memcpy(type, var_type, sizeof(*type));
}
/* Calculate the data size */
@@ -88,7 +89,8 @@ bool bgenv_validate_uservars(uint8_t *udata)
spaceleft -= key_len + 1;
udata += key_len + 1;
- uint32_t payload_size = *(uint32_t *)udata;
+ uint32_t payload_size;
+ memcpy(&payload_size, udata, sizeof(payload_size));
/* the payload must leave at least one byte free */
if (payload_size >= spaceleft) {
@@ -166,7 +168,7 @@ static void bgenv_serialize_uservar(uint8_t *p, char *key,
uint64_t type,
p += sizeof(uint32_t);
/* store datatype */
- *((uint64_t *)p) = type;
+ memcpy(p, &type, sizeof(uint64_t));
p += sizeof(uint64_t);
/* store data */
--
2.43.0
--
You received this message because you are subscribed to the Google Groups "EFI
Boot Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to efibootguard-dev+unsubscr...@googlegroups.com.
To view this discussion visit
https://groups.google.com/d/msgid/efibootguard-dev/df13860390e480306de6148356bc7eef4a72616d.1747253700.git.jan.kiszka%40siemens.com.
