From: Razvan Becheriu <razvan@isc.org>
Date: Thu, 8 Jun 2023 17:02:30 +0000 (+0300)
Subject: [#2830] fixed UB caused by unalligned read
X-Git-Tag: Kea-2.4.0~160
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fd6262fd333d01a9d2637c4902e619bc21a14400;p=thirdparty%2Fkea.git

[#2830] fixed UB caused by unalligned read
---

diff --git a/src/lib/eval/tests/token_unittest.cc b/src/lib/eval/tests/token_unittest.cc
index c18665840a..a913cb56dc 100644
--- a/src/lib/eval/tests/token_unittest.cc
+++ b/src/lib/eval/tests/token_unittest.cc
@@ -896,14 +896,18 @@ TEST_F(TokenTest, integerToText) {
     // Check that the evaluation put its value on the values stack.
     ASSERT_EQ(1, values_.size());
 
-    values_.push(std::string(const_cast<const char *>(reinterpret_cast<char*>(&data)), sizeof(int16_t)));
+    int16_t i16 = 0;
+    memcpy(&i16, &data, sizeof(int16_t));
+    values_.push(std::string(const_cast<const char *>(reinterpret_cast<char*>(&i16)), sizeof(int16_t)));
 
     EXPECT_NO_THROW(int16token->evaluate(*pkt4_, values_));
 
     // Check that the evaluation put its value on the values stack.
     ASSERT_EQ(2, values_.size());
 
-    values_.push(std::string(const_cast<const char *>(reinterpret_cast<char*>(&data)), sizeof(int32_t)));
+    int32_t i32 = 0;
+    memcpy(&i32, &data, sizeof(int32_t));
+    values_.push(std::string(const_cast<const char *>(reinterpret_cast<char*>(&i32)), sizeof(int32_t)));
 
     EXPECT_NO_THROW(int32token->evaluate(*pkt4_, values_));
 
@@ -917,14 +921,18 @@ TEST_F(TokenTest, integerToText) {
     // Check that the evaluation put its value on the values stack.
     ASSERT_EQ(4, values_.size());
 
-    values_.push(std::string(const_cast<const char *>(reinterpret_cast<char*>(&data)), sizeof(uint16_t)));
+    uint16_t ui16 = 0;
+    memcpy(&ui16, &data, sizeof(uint16_t));
+    values_.push(std::string(const_cast<const char *>(reinterpret_cast<char*>(&ui16)), sizeof(uint16_t)));
 
     EXPECT_NO_THROW(uint16token->evaluate(*pkt4_, values_));
 
     // Check that the evaluation put its value on the values stack.
     ASSERT_EQ(5, values_.size());
 
-    values_.push(std::string(const_cast<const char *>(reinterpret_cast<char*>(&data)), sizeof(uint32_t)));
+    uint32_t ui32 = 0;
+    memcpy(&ui32, &data, sizeof(uint32_t));
+    values_.push(std::string(const_cast<const char *>(reinterpret_cast<char*>(&ui32)), sizeof(uint32_t)));
 
     EXPECT_NO_THROW(uint32token->evaluate(*pkt4_, values_));
 
diff --git a/src/lib/eval/token.cc b/src/lib/eval/token.cc
index 34993d7ddb..16b1d22776 100644
--- a/src/lib/eval/token.cc
+++ b/src/lib/eval/token.cc
@@ -191,9 +191,9 @@ TokenInt16ToText::evaluate(Pkt& /*pkt*/, ValueStack& values) {
     }
 
     stringstream tmp;
-    uint16_t value = *(reinterpret_cast<uint16_t*>(const_cast<char*>(op.data())));
-    std::string data = EvalContext::fromUint16(value);
-    tmp << *(reinterpret_cast<int16_t*>(const_cast<char*>(data.data())));
+    int16_t value = 0;
+    memcpy(&value, op.data(), size);
+    tmp << value;
     op = tmp.str();
     values.push(op);
 
@@ -222,9 +222,9 @@ TokenInt32ToText::evaluate(Pkt& /*pkt*/, ValueStack& values) {
     }
 
     stringstream tmp;
-    uint32_t value = *(reinterpret_cast<uint32_t*>(const_cast<char*>(op.data())));
-    std::string data = EvalContext::fromUint32(value);
-    tmp << *(reinterpret_cast<int32_t*>(const_cast<char*>(data.data())));
+    int32_t value = 0;
+    memcpy(&value, op.data(), size);
+    tmp << value;
     op = tmp.str();
     values.push(op);
 
@@ -282,9 +282,9 @@ TokenUInt16ToText::evaluate(Pkt& /*pkt*/, ValueStack& values) {
     }
 
     stringstream tmp;
-    uint16_t value = *(reinterpret_cast<uint16_t*>(const_cast<char*>(op.data())));
-    std::string data = EvalContext::fromUint16(value);
-    tmp << *(reinterpret_cast<uint16_t*>(const_cast<char*>(data.data())));
+    uint16_t value = 0;
+    memcpy(&value, op.data(), size);
+    tmp << value;
     op = tmp.str();
     values.push(op);
 
@@ -313,9 +313,9 @@ TokenUInt32ToText::evaluate(Pkt& /*pkt*/, ValueStack& values) {
     }
 
     stringstream tmp;
-    uint32_t value = *(reinterpret_cast<uint32_t*>(const_cast<char*>(op.data())));
-    std::string data = EvalContext::fromUint32(value);
-    tmp << *(reinterpret_cast<uint32_t*>(const_cast<char*>(data.data())));
+    uint32_t value = 0;
+    memcpy(&value, op.data(), size);
+    tmp << value;
     op = tmp.str();
     values.push(op);