From d3f298c592f81ac6ea0bd42932da551fd8a50730 Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Mon, 24 May 2021 09:04:22 +0200 Subject: [PATCH] LibIPC: Fix unaligned u32 access in drain_messages_from_peer() Caught by userspace UBSAN. :^) --- Userland/Libraries/LibIPC/Connection.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Userland/Libraries/LibIPC/Connection.h b/Userland/Libraries/LibIPC/Connection.h index 555b5e67df..3ac101c69a 100644 --- a/Userland/Libraries/LibIPC/Connection.h +++ b/Userland/Libraries/LibIPC/Connection.h @@ -207,9 +207,9 @@ protected: } size_t index = 0; - uint32_t message_size = 0; + u32 message_size = 0; for (; index + sizeof(message_size) < bytes.size(); index += message_size) { - message_size = *reinterpret_cast(bytes.data() + index); + memcpy(&message_size, bytes.data() + index, sizeof(message_size)); if (message_size == 0 || bytes.size() - index - sizeof(uint32_t) < message_size) break; index += sizeof(message_size);