Skip to content

ip: Enforce strict aliasing

小田喜陽彦 requested to merge akihiko.odaki/libslirp:master into master

Sometimes ipq were casted to ipasfrag, and the original and casted pointer were used simultaneously in ip_reass(). GCC 12.1.0 assumes these pointers are not aliases, and therefore incorrectly the pointed data will not be modified when it is actually modified with another pointer.

To fix this problem, introduce a new type "ipas", which is a universal type denoting an entry in the assembly queue and contains union for specialization as queue head (frequently referred as "q" or "ipq" in the source code) or IP fragment ("f" or "ipf").

This bug was found by Alexander Bulekov when fuzzing QEMU: https://patchew.org/QEMU/20230129053316.1071513-1-alxndr@bu.edu/

The fixed test case is: fuzz/crash_449dd4ad72212627fe3245c875f79a7033cc5382

Signed-off-by: Akihiko Odaki akihiko.odaki@daynix.com

Merge request reports