Re: [Qemu-devel] [PATCH] vnc: fix unalignment access in tight_pack24

[Peter Maydell]

On Sun, 17 Mar 2019 at 12:09, Li Qiang <address@hidden> wrote:
>
> When adding '-fsanitize=undefined' in compiling configuration
> and connect VM with vnc, it reports following error:
>
> ui/vnc-enc-tight.c:910:13: runtime error: load of
> misaligned address 0x621000466513 for type 'uint32_t',
> which requires 4 byte alignment
>
> This patch fix this issue.
>
> Signed-off-by: Li Qiang <address@hidden>
> ---
>  ui/vnc-enc-tight.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
> index 0b4a5ac71f..7e1be63af3 100644
> --- a/ui/vnc-enc-tight.c
> +++ b/ui/vnc-enc-tight.c
> @@ -886,11 +886,11 @@ static int tight_compress_data(VncState *vs, int 
> stream_id, size_t bytes,
>   */
>  static void tight_pack24(VncState *vs, uint8_t *buf, size_t count, size_t 
> *ret)
>  {
> -    uint32_t *buf32;
> +    uint8_t *buf8;
>      uint32_t pix;
>      int rshift, gshift, bshift;
>
> -    buf32 = (uint32_t *)buf;
> +    buf8 = buf;
>
>      if (1 /* FIXME */) {
>          rshift = vs->client_pf.rshift;
> @@ -907,10 +907,11 @@ static void tight_pack24(VncState *vs, uint8_t *buf, 
> size_t count, size_t *ret)
>      }
>
>      while (count--) {
> -        pix = *buf32++;
> +        memcpy(&pix, buf8, sizeof(uint32_t));

Better to use ldl_he_p() rather than hand-rolling
an unaligned accessor with memcpy(), I think.

Is the input data definitely in host endianness
order ?

>          *buf++ = (char)(pix >> rshift);
>          *buf++ = (char)(pix >> gshift);
>          *buf++ = (char)(pix >> bshift);
> +        buf8 += 4;
>      }
>  }
>
> --
> 2.17.1

thanks
-- PMM