Skip to content

Commit 53073c8

Browse files
committed
libvncserver: fix pointer aliasing/alignment issue
Accessing byte-aligned data through uint16_t pointers can cause crashes on some platforms or reduce the performance. Therefore ensure a proper stack alignment.
1 parent e453a44 commit 53073c8

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

Diff for: libvncserver/translate.c

+7-4
Original file line numberDiff line numberDiff line change
@@ -360,9 +360,12 @@ rfbSetTranslateFunction(rfbClientPtr cl)
360360
static rfbBool
361361
rfbSetClientColourMapBGR233(rfbClientPtr cl)
362362
{
363-
char buf[sz_rfbSetColourMapEntriesMsg + 256 * 3 * 2];
364-
rfbSetColourMapEntriesMsg *scme = (rfbSetColourMapEntriesMsg *)buf;
365-
uint16_t *rgb = (uint16_t *)(&buf[sz_rfbSetColourMapEntriesMsg]);
363+
union {
364+
char bytes[sz_rfbSetColourMapEntriesMsg + 256 * 3 * 2];
365+
rfbSetColourMapEntriesMsg msg;
366+
} buf;
367+
rfbSetColourMapEntriesMsg *scme = &buf.msg;
368+
uint16_t *rgb = (uint16_t *)(&buf.bytes[sz_rfbSetColourMapEntriesMsg]);
366369
int i, len;
367370
int r, g, b;
368371

@@ -394,7 +397,7 @@ rfbSetClientColourMapBGR233(rfbClientPtr cl)
394397

395398
len += 256 * 3 * 2;
396399

397-
if (rfbWriteExact(cl, buf, len) < 0) {
400+
if (rfbWriteExact(cl, buf.bytes, len) < 0) {
398401
rfbLogPerror("rfbSetClientColourMapBGR233: write");
399402
rfbCloseClient(cl);
400403
return FALSE;

0 commit comments

Comments
 (0)