From 1e90bd919b8ed104e3c77e411ab32060b4a1e39e Mon Sep 17 00:00:00 2001 From: David Oberhollenzer Date: Fri, 25 Jun 2021 13:24:47 +0200 Subject: libcommon: remove potentially un-aligned access in LZO compressor When accessing the 16 bit header, don't cast the buffer pointer to an uint16_t pointer, the result might not be aligned propperly. Instead memcpy to and from an uint16_t. Signed-off-by: David Oberhollenzer --- lib/common/comp_lzo.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/lib/common/comp_lzo.c b/lib/common/comp_lzo.c index e5e7ffb..3a7dce1 100644 --- a/lib/common/comp_lzo.c +++ b/lib/common/comp_lzo.c @@ -69,6 +69,7 @@ static int lzo_write_options(sqfs_compressor_t *base, sqfs_file_t *file) lzo_compressor_t *lzo = (lzo_compressor_t *)base; sqfs_u8 buffer[sizeof(lzo_options_t) + 2]; lzo_options_t opt; + sqfs_u16 header; int ret; if (lzo->algorithm == SQFS_LZO_DEFAULT_ALG && @@ -84,7 +85,9 @@ static int lzo_write_options(sqfs_compressor_t *base, sqfs_file_t *file) opt.level = 0; } - *((sqfs_u16 *)buffer) = htole16(0x8000 | sizeof(opt)); + header = htole16(0x8000 | sizeof(opt)); + + memcpy(buffer, &header, sizeof(header)); memcpy(buffer + 2, &opt, sizeof(opt)); ret = file->write_at(file, sizeof(sqfs_super_t), @@ -98,6 +101,7 @@ static int lzo_read_options(sqfs_compressor_t *base, sqfs_file_t *file) lzo_compressor_t *lzo = (lzo_compressor_t *)base; sqfs_u8 buffer[sizeof(lzo_options_t) + 2]; lzo_options_t opt; + sqfs_u16 header; int ret; ret = file->read_at(file, sizeof(sqfs_super_t), @@ -105,7 +109,8 @@ static int lzo_read_options(sqfs_compressor_t *base, sqfs_file_t *file) if (ret) return ret; - if (le16toh(*((sqfs_u16 *)buffer)) != (0x8000 | sizeof(opt))) + memcpy(&header, buffer, sizeof(header)); + if (le16toh(header) != (0x8000 | sizeof(opt))) return SQFS_ERROR_CORRUPTED; memcpy(&opt, buffer + 2, sizeof(opt)); -- cgit v1.2.3