On 08/25/2013 12:47 PM, Kurt Roeckx wrote:
- *dst = ((GElf_auxv_t *) data_scn->d.d_buf)[ndx];
+ memcpy(dst, &((GElf_auxv_t *) data_scn->d.d_buf)[ndx], sizeof(*dst));
That's not correct, the cast is already undefined if the pointer lacks
sufficient alignment. GCC might even translate the latter into the former.
This might do it:
memcpy(dst, data_scn->d.d_buf + ndx * sizeof(GElf_auxv_t),
sizeof(GElf_axuv_t));
(I hope there's a bounds check on ndx before that. :-)
--
Florian Weimer / Red Hat Product Security Team