Backport of: From 0cf1400c61850065de590d403f6d49e32882fd76 Mon Sep 17 00:00:00 2001 From: Rolf Eike Beer Date: Tue, 28 May 2019 18:30:46 +0200 Subject: [PATCH] fix crash because of unaligned accesses in hybiReadAndDecode() [Ubuntu note: patch backported to apply on libvncserver/websockets.c instead of libvncserver/ws_decode.c -- Avital] --- libvncserver/ws_decode.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/libvncserver/websockets.c +++ b/libvncserver/websockets.c @@ -880,7 +880,6 @@ hybiReadAndDecode(rfbClientPtr cl, char int bufsize; int nextRead; unsigned char *data; - uint32_t *data32; ws_ctx_t *wsctx = (ws_ctx_t *)cl->wsctx; /* if data was carried over, copy to start of buffer */ @@ -938,10 +937,12 @@ hybiReadAndDecode(rfbClientPtr cl, char /* for a possible base64 decoding, we decode multiples of 4 bytes until * the whole frame is received and carry over any remaining bytes in the carry buf*/ data = (unsigned char *)hybiPayloadStart(wsctx); - data32= (uint32_t *)data; for (i = 0; i < (toDecode >> 2); i++) { - data32[i] ^= wsctx->header.mask.u; + uint32_t tmp; + memcpy(&tmp, data + i * sizeof(tmp), sizeof(tmp)); + tmp ^= wsctx->header.mask.u; + memcpy(data + i * sizeof(tmp), &tmp, sizeof(tmp)); } rfbLog("mask decoding; i=%d toDecode=%d\n", i, toDecode);