From db5486aa73f5b17878ac6e5ccc1a14de019ad01e Mon Sep 17 00:00:00 2001
From: djm <djm@openbsd.org>
Date: Sun, 20 Apr 2014 02:30:25 +0000
Subject: [PATCH] use get/put_u32 to load values rather than *((UINT32 *)p)
 that breaks on strict-alignment architectures; reported by and ok stsp@

---
 usr.bin/ssh/misc.c | 26 +++++++++++++++++++++++++-
 usr.bin/ssh/misc.h |  8 +++++++-
 usr.bin/ssh/umac.c | 43 ++++++++++++++-----------------------------
 3 files changed, 46 insertions(+), 31 deletions(-)

diff --git a/usr.bin/ssh/misc.c b/usr.bin/ssh/misc.c
index 7a73109ddcc..51fd8f72112 100644
--- a/usr.bin/ssh/misc.c
+++ b/usr.bin/ssh/misc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: misc.c,v 1.92 2013/10/14 23:28:23 djm Exp $ */
+/* $OpenBSD: misc.c,v 1.93 2014/04/20 02:30:25 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2005,2006 Damien Miller.  All rights reserved.
@@ -765,6 +765,20 @@ get_u32(const void *vp)
 	return (v);
 }
 
+u_int32_t
+get_u32_le(const void *vp)
+{
+	const u_char *p = (const u_char *)vp;
+	u_int32_t v;
+
+	v  = (u_int32_t)p[0];
+	v |= (u_int32_t)p[1] << 8;
+	v |= (u_int32_t)p[2] << 16;
+	v |= (u_int32_t)p[3] << 24;
+
+	return (v);
+}
+
 u_int16_t
 get_u16(const void *vp)
 {
@@ -803,6 +817,16 @@ put_u32(void *vp, u_int32_t v)
 	p[3] = (u_char)v & 0xff;
 }
 
+void
+put_u32_le(void *vp, u_int32_t v)
+{
+	u_char *p = (u_char *)vp;
+
+	p[0] = (u_char)v & 0xff;
+	p[1] = (u_char)(v >> 8) & 0xff;
+	p[2] = (u_char)(v >> 16) & 0xff;
+	p[3] = (u_char)(v >> 24) & 0xff;
+}
 
 void
 put_u16(void *vp, u_int16_t v)
diff --git a/usr.bin/ssh/misc.h b/usr.bin/ssh/misc.h
index 55870477877..435122e315b 100644
--- a/usr.bin/ssh/misc.h
+++ b/usr.bin/ssh/misc.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: misc.h,v 1.51 2014/03/26 04:55:35 djm Exp $ */
+/* $OpenBSD: misc.h,v 1.52 2014/04/20 02:30:25 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -80,6 +80,12 @@ void		put_u32(void *, u_int32_t)
 void		put_u16(void *, u_int16_t)
     __bounded(( __minbytes__, 1, 2));
 
+/* Little-endian store/load, used by umac.c */
+u_int32_t	get_u32_le(const void *)
+    __bounded(( __minbytes__, 1, 4));
+void		put_u32_le(void *, u_int32_t)
+    __bounded(( __minbytes__, 1, 4));
+
 struct bwlimit {
 	size_t buflen;
 	u_int64_t rate, thresh, lamt;
diff --git a/usr.bin/ssh/umac.c b/usr.bin/ssh/umac.c
index 5e53a9f75cf..783614f84df 100644
--- a/usr.bin/ssh/umac.c
+++ b/usr.bin/ssh/umac.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: umac.c,v 1.8 2013/11/08 00:39:15 djm Exp $ */
+/* $OpenBSD: umac.c,v 1.9 2014/04/20 02:30:25 djm Exp $ */
 /* -----------------------------------------------------------------------
  * 
  * umac.c -- C Implementation UMAC Message Authentication
@@ -65,13 +65,15 @@
 
 #include <sys/types.h>
 #include <sys/endian.h>
-
-#include "xmalloc.h"
-#include "umac.h"
 #include <string.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <stddef.h>
 
+#include "xmalloc.h"
+#include "umac.h"
+#include "misc.h"
+
 /* ---------------------------------------------------------------------- */
 /* --- Primitive Data Types ---                                           */
 /* ---------------------------------------------------------------------- */
@@ -123,38 +125,21 @@ typedef unsigned int	UWORD;  /* Register */
 /* --- Endian Conversion --- Forcing assembly on some platforms           */
 /* ---------------------------------------------------------------------- */
 
-#if 0
-static UINT32 LOAD_UINT32_REVERSED(const void *ptr)
-{
-    UINT32 temp = *(const UINT32 *)ptr;
-    temp = (temp >> 24) | ((temp & 0x00FF0000) >> 8 )
-         | ((temp & 0x0000FF00) << 8 ) | (temp << 24);
-    return (UINT32)temp;
-}
-
-static void STORE_UINT32_REVERSED(void *ptr, UINT32 x)
-{
-    UINT32 i = (UINT32)x;
-    *(UINT32 *)ptr = (i >> 24) | ((i & 0x00FF0000) >> 8 )
-                   | ((i & 0x0000FF00) << 8 ) | (i << 24);
-}
-#endif
-
 /* The following definitions use the above reversal-primitives to do the right
  * thing on endian specific load and stores.
  */
 
-#define LOAD_UINT32_REVERSED(p)		(swap32(*(const UINT32 *)(p)))
-#define STORE_UINT32_REVERSED(p,v) 	(*(UINT32 *)(p) = swap32(v))
-
-#if (__LITTLE_ENDIAN__)
-#define LOAD_UINT32_LITTLE(ptr)     (*(const UINT32 *)(ptr))
-#define STORE_UINT32_BIG(ptr,x)     STORE_UINT32_REVERSED(ptr,x)
+#if BYTE_ORDER == LITTLE_ENDIAN
+#define LOAD_UINT32_REVERSED(p)		get_u32(p)
+#define STORE_UINT32_REVERSED(p,v) 	put_u32(p,v)
 #else
-#define LOAD_UINT32_LITTLE(ptr)     LOAD_UINT32_REVERSED(ptr)
-#define STORE_UINT32_BIG(ptr,x)     (*(UINT32 *)(ptr) = (UINT32)(x))
+#define LOAD_UINT32_REVERSED(p)		get_u32_le(p)
+#define STORE_UINT32_REVERSED(p,v) 	put_u32_le(p,v)
 #endif
 
+#define LOAD_UINT32_LITTLE(p)           (get_u32_le(p))
+#define STORE_UINT32_BIG(p,v)           put_u32(p, v)
+
 
 
 /* ---------------------------------------------------------------------- */
-- 
2.20.1