Fix a pointer aliasing violation by explicitly breaking aliasing with a

call to memcpy().

diff --git a/config.h b/config.h
index c9fe702945e0ab5ef3a37adb5306c3a6e128ed39..e9fc3ac6ffe3647932aa3dc02ee97aa611c308f8 100644 (file)
--- a/config.h
+++ b/config.h
@@ -153,7 +153,7 @@
 #define STDC_HEADERS 1
 
 /* Most recent revision number in the version control system */
-#define VCS_REVISION "219"
+#define VCS_REVISION "220"
 
 /* Version number of package */
 #define VERSION "2.10"

diff --git a/configure b/configure
index be80a0b1abeafab07aef8bc3c41513b9df10f3a5..801ff0a7c22541bce08cbec69754d213ac733928 100755 (executable)
--- a/configure
+++ b/configure
@@ -2328,7 +2328,7 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
-VCS_REVISION=219
+VCS_REVISION=220
 
 
 cat >>confdefs.h <<_ACEOF

diff --git a/configure.ac b/configure.ac
index 740224b7da17164693112c2991ce03e028571c5d..53fa250eb0019c295ce81c489cbd0605d7ba0640 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@ AC_PREREQ(2.57)
 
 dnl This is the one location where the authoritative version number is stored
 AC_INIT(shellinabox, 2.10, markus@shellinabox.com)
-VCS_REVISION=219
+VCS_REVISION=220
 AC_SUBST(VCS_REVISION)
 AC_DEFINE_UNQUOTED(VCS_REVISION, "${VCS_REVISION}",
                    [Most recent revision number in the version control system])

diff --git a/demo/vt100.js b/demo/vt100.js
index a12b493010cc4ce3745a874b3ba6317fe77b57d3..f9345b9d3952ac5e769e779f1441b51ff13e8200 100644 (file)
--- a/demo/vt100.js
+++ b/demo/vt100.js
@@ -1974,7 +1974,7 @@ VT100.prototype.toggleCursorBlinking = function() {
 };
 
 VT100.prototype.about = function() {
-  alert("VT100 Terminal Emulator " + "2.10 (revision 219)" +
+  alert("VT100 Terminal Emulator " + "2.10 (revision 220)" +
         "\nCopyright 2008-2010 by Markus Gutschke\n" +
         "For more information check http://shellinabox.com");
 };

diff --git a/libhttp/server.c b/libhttp/server.c
index 41dfcb0175f6b081d929b1bf52674db7a9e10de0..3b115869c5167e1449fa5d4c78f6e9c3ba60f0f8 100644 (file)
--- a/libhttp/server.c
+++ b/libhttp/server.c
@@ -354,11 +354,25 @@ struct ServerConnection *serverGetConnection(struct Server *server,
                                              int fd) {
   if (hint &&
       server->connections <= hint &&
-      server->connections + server->numConnections > hint &&
-      &server->connections[hint - server->connections] == hint &&
-      !hint->deleted &&
-      server->pollFds[hint - server->connections + 1].fd == fd) {
-    return hint;
+      server->connections + server->numConnections > hint) {
+    // The compiler would like to optimize the expression:
+    //   &server->connections[hint - server->connections]     <=>
+    //   server->connections + hint - server->connections     <=>
+    //   hint
+    // This transformation is correct as far as the language specification is
+    // concerned, but it is unintended as we actually want to check whether
+    // the alignment is correct. So, instead of comparing
+    //   &server->connections[hint - server->connections] == hint
+    // we first use memcpy() to break aliasing.
+    uintptr_t ptr1, ptr2;
+    memcpy(&ptr1, &hint, sizeof(ptr1));
+    memcpy(&ptr2, &server->connections, sizeof(ptr2));
+    int idx = (ptr1 - ptr2)/sizeof(*server->connections);
+    if (&server->connections[idx] == hint &&
+        !hint->deleted &&
+        server->pollFds[hint - server->connections + 1].fd == fd) {
+      return hint;
+    }
   }
   for (int i = 0; i < server->numConnections; i++) {
     if (server->pollFds[i + 1].fd == fd && !server->connections[i].deleted) {

diff --git a/shellinabox/shell_in_a_box.js b/shellinabox/shell_in_a_box.js
index 7d46858501b6b6ac384554e9d379b72faaf1d72e..523d7e0c6eeda15ea55b99804f2e83a3fa95a8c7 100644 (file)
--- a/shellinabox/shell_in_a_box.js
+++ b/shellinabox/shell_in_a_box.js
@@ -358,7 +358,7 @@ ShellInABox.prototype.extendContextMenu = function(entries, actions) {
 };
 
 ShellInABox.prototype.about = function() {
-  alert("Shell In A Box version " + "2.10 (revision 219)" +
+  alert("Shell In A Box version " + "2.10 (revision 220)" +
         "\nCopyright 2008-2010 by Markus Gutschke\n" +
         "For more information check http://shellinabox.com" +
         (typeof serverSupportsSSL != 'undefined' && serverSupportsSSL ?

diff --git a/shellinabox/vt100.js b/shellinabox/vt100.js
index a12b493010cc4ce3745a874b3ba6317fe77b57d3..f9345b9d3952ac5e769e779f1441b51ff13e8200 100644 (file)
--- a/shellinabox/vt100.js
+++ b/shellinabox/vt100.js
@@ -1974,7 +1974,7 @@ VT100.prototype.toggleCursorBlinking = function() {
 };
 
 VT100.prototype.about = function() {
-  alert("VT100 Terminal Emulator " + "2.10 (revision 219)" +
+  alert("VT100 Terminal Emulator " + "2.10 (revision 220)" +
         "\nCopyright 2008-2010 by Markus Gutschke\n" +
         "For more information check http://shellinabox.com");
 };