Module Name: src
Committed By: rin
Date: Mon Jul 29 08:13:50 UTC 2019
Modified Files:
src/sys/dev/rasops: rasops.h rasops1.c rasops_putchar.h
Log Message:
Avoid undefined behavior when converting unaligned be32 data to
host integer, found by kUBSan.
Pointed out by msaitoh.
To generate a diff of this commit:
cvs rdiff -u -r1.37 -r1.38 src/sys/dev/rasops/rasops.h
cvs rdiff -u -r1.29 -r1.30 src/sys/dev/rasops/rasops1.c
cvs rdiff -u -r1.3 -r1.4 src/sys/dev/rasops/rasops_putchar.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/rasops/rasops.h
diff -u src/sys/dev/rasops/rasops.h:1.37 src/sys/dev/rasops/rasops.h:1.38
--- src/sys/dev/rasops/rasops.h:1.37 Sun Jul 28 12:06:10 2019
+++ src/sys/dev/rasops/rasops.h Mon Jul 29 08:13:50 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: rasops.h,v 1.37 2019/07/28 12:06:10 rin Exp $ */
+/* $NetBSD: rasops.h,v 1.38 2019/07/29 08:13:50 rin Exp $ */
/*-
* Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -153,6 +153,18 @@ struct rasops_info {
((uint8_t *)(font)->data + ((uc) - ((font)->firstchar)) * \
(ri)->ri_fontscale)
+static __inline uint32_t
+be32uatoh(uint8_t *p)
+{
+ uint32_t u;
+
+ u = p[0]; u <<= 8;
+ u |= p[1]; u <<= 8;
+ u |= p[2]; u <<= 8;
+ u |= p[3];
+ return u;
+}
+
/*
* rasops_init().
*
Index: src/sys/dev/rasops/rasops1.c
diff -u src/sys/dev/rasops/rasops1.c:1.29 src/sys/dev/rasops/rasops1.c:1.30
--- src/sys/dev/rasops/rasops1.c:1.29 Mon Jul 29 02:57:41 2019
+++ src/sys/dev/rasops/rasops1.c Mon Jul 29 08:13:50 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: rasops1.c,v 1.29 2019/07/29 02:57:41 rin Exp $ */
+/* $NetBSD: rasops1.c,v 1.30 2019/07/29 08:13:50 rin Exp $ */
/*-
* Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rasops1.c,v 1.29 2019/07/29 02:57:41 rin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rasops1.c,v 1.30 2019/07/29 08:13:50 rin Exp $");
#include "opt_rasops.h"
@@ -151,8 +151,7 @@ rasops1_putchar(void *cookie, int row, i
} else {
while (height--) {
tmp = *rp & lmask;
- fb = fr[3] | (fr[2] << 8) |
- (fr[1] << 16) | (fr[0] << 24);
+ fb = be32uatoh(fr);
fr += fs;
if (bg)
fb = ~fb;
@@ -202,8 +201,7 @@ rasops1_putchar(void *cookie, int row, i
while (height--) {
tmp0 = rp[0] & lmask;
tmp1 = rp[1] & rmask;
- fb = fr[3] | (fr[2] << 8) |
- (fr[1] << 16) | (fr[0] << 24);
+ fb = be32uatoh(fr);
fr += fs;
if (bg)
fb = ~fb;
Index: src/sys/dev/rasops/rasops_putchar.h
diff -u src/sys/dev/rasops/rasops_putchar.h:1.3 src/sys/dev/rasops/rasops_putchar.h:1.4
--- src/sys/dev/rasops/rasops_putchar.h:1.3 Sun Jul 28 12:10:52 2019
+++ src/sys/dev/rasops/rasops_putchar.h Mon Jul 29 08:13:50 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: rasops_putchar.h,v 1.3 2019/07/28 12:10:52 rin Exp $ */
+/* $NetBSD: rasops_putchar.h,v 1.4 2019/07/29 08:13:50 rin Exp $ */
/* NetBSD: rasops8.c,v 1.41 2019/07/25 03:02:44 rin Exp */
/*-
@@ -70,7 +70,8 @@ PUTCHAR(RASOPS_DEPTH)(void *cookie, int
{
struct rasops_info *ri = (struct rasops_info *)cookie;
struct wsdisplay_font *font = PICK_FONT(ri, uc);
- int width, height, cnt, fs, fb;
+ int width, height, cnt, fs;
+ uint32_t fb;
uint8_t *dp, *rp, *hp, *hrp, *fr;
CLR_TYPE clr[2];
@@ -124,8 +125,7 @@ PUTCHAR(RASOPS_DEPTH)(void *cookie, int
hp = hrp;
hrp += ri->ri_stride;
}
- fb = fr[3] | (fr[2] << 8) | (fr[1] << 16) |
- (fr[0] << 24);
+ fb = be32uatoh(fr);
fr += fs;
for (cnt = width; cnt; cnt--) {
SUBST_CLR(dp, (fb >> 31) & 1);
