From 1e98a6b5a87db80f445f3c7a8322c9d30e7dc71d Mon Sep 17 00:00:00 2001 From: "Eric S. Raymond" Date: Thu, 21 Aug 2014 07:41:56 -0400 Subject: Reimplement Zodiac control-send safely for word-oriented architectures. This was a bug revealed by Debian porterbox testing. We used to use a cast from (char *) to (unsigned short *) that was problematic on word-oriented architectures like the PowerPC. Instead, memcpy the message data to a word array, which the compiler will create with correct alignment. All regression tests, cppcheck, and splint pass. --- driver_zodiac.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'driver_zodiac.c') diff --git a/driver_zodiac.c b/driver_zodiac.c index 6c390b88..b1c9a966 100644 --- a/driver_zodiac.c +++ b/driver_zodiac.c @@ -396,11 +396,20 @@ static gps_mask_t zodiac_analyze(struct gps_device_t *session) static ssize_t zodiac_control_send(struct gps_device_t *session, char *msg, size_t len) { - unsigned short *shortwords = (unsigned short *)msg; + /*@-usedef -compdef@*/ + unsigned short shortwords[256]; + +#define min(x,y) ((x) < (y) ? x : y) + /* + * We used to just cast msg to an unsigned short pointer. + * This can fail on word-oriented achitectures like a SPARC. + */ + memcpy((char *)shortwords, msg, min(sizeof(shortwords), len)); /* and if len isn't even, it's your own fault */ return zodiac_spew(session, shortwords[0], shortwords + 1, (int)(len / 2 - 1)); + /*@+usedef +compdef@*/ } #endif /* CONTROLSEND_ENABLE */ -- cgit v1.2.1