From: DJ Delorie <dj@delorie.com>
Date: Sat, 15 Jul 2017 01:46:42 +0000 (-0400)
Subject: Fix BZ #21654 - grp-merge.c alignment
X-Git-Tag: glibc-2.26~93
X-Git-Url: http://git.ipfire.org/?p=thirdparty%2Fglibc.git;a=commitdiff_plain;h=4fa8ae49aa169fb8d97882938e8bee3ed9ce5410

Fix BZ #21654 - grp-merge.c alignment

* grp/grp_merge.c (__copy_grp): Align char** to minimum pointer
alignment not char alignment.
(__merge_grp): Likewise.
---

diff --git a/ChangeLog b/ChangeLog
index 96c76f72ec8..a9044a588cb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2017-07-14  DJ Delorie  <dj@redhat.com>
+
+	[BZ #21654]
+	* grp/grp_merge.c (__copy_grp): Align char** to minimum pointer
+	alignment not char alignment.
+	(__merge_grp): Likewise.
+
 2017-07-14  Szabolcs Nagy  <szabolcs.nagy@arm.com>
 	    Florian Weimer  <fweimer@redhat.com>
 
diff --git a/grp/grp-merge.c b/grp/grp-merge.c
index 77c494d1595..6590e5d8235 100644
--- a/grp/grp-merge.c
+++ b/grp/grp-merge.c
@@ -85,6 +85,14 @@ __copy_grp (const struct group srcgrp, const size_t buflen,
     }
   members[i] = NULL;
 
+  /* Align for pointers.  We can't simply align C because we need to
+     align destbuf[c].  */
+  if ((((uintptr_t)destbuf + c) & (__alignof__(char **) - 1)) != 0)
+    {
+      uintptr_t mis_align = ((uintptr_t)destbuf + c) & (__alignof__(char **) - 1);
+      c += __alignof__(char **) - mis_align;
+    }
+
   /* Copy the pointers from the members array into the buffer and assign them
      to the gr_mem member of destgrp.  */
   destgrp->gr_mem = (char **) &destbuf[c];
@@ -168,6 +176,14 @@ __merge_grp (struct group *savedgrp, char *savedbuf, char *savedend,
   /* Add the NULL-terminator.  */
   members[savedmemcount + memcount] = NULL;
 
+  /* Align for pointers.  We can't simply align C because we need to
+     align savedbuf[c].  */
+  if ((((uintptr_t)savedbuf + c) & (__alignof__(char **) - 1)) != 0)
+    {
+      uintptr_t mis_align = ((uintptr_t)savedbuf + c) & (__alignof__(char **) - 1);
+      c += __alignof__(char **) - mis_align;
+    }
+
   /* Copy the member array back into the buffer after the member list and free
      the member array.  */
   savedgrp->gr_mem = (char **) &savedbuf[c];