[PATCH v2] expand: fix SIGBUS due to unaligned access

Natanael Copa <[email protected]> Fri, 16 Jan 2026 21:55:39 +0100
Newsgroups org.kernel.vger.dash
Message-ID <[email protected]>
Replace direct uint64_t dereference with memcpy() to avoid
SIGBUS on armv7 when p is not 8-byte aligned.

Fixes crashes in dash during IFS splitting on strict-alignment
architectures.

Signed-off-by: Natanael Copa <[email protected]>
---
 src/expand.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

v2:
- Added a couple more instances of unaligned access.

diff --git a/src/expand.c b/src/expand.c
index 8c8bf0e..98b65ba 100644
--- a/src/expand.c
+++ b/src/expand.c
@@ -961,13 +961,14 @@ static size_t memtodest(const char *p, size_t len, int flags)
 	if (likely(!(flags & (expq >> 3 | expq >> 4 | expq >> 8) &
 		     (QUOTES_ESC | EXP_MBCHAR)))) {
 		while (len >= 8) {
-			uint64_t x = *(uint64_t *)(p + count);
+			uint64_t x;
+			memcpy(&x, p + count, sizeof(x));
 
 			if ((x | (x - 0x0101010101010101)) &
 			    0x8080808080808080)
 				break;
 
-			*(uint64_t *)(q + count) = x;
+			memcpy(q + count, &x, sizeof(x));
 
 			count += 8;
 			len -= 8;
@@ -1335,7 +1336,7 @@ ifsbreakup(char *string, int maxargs, struct arglist *arglist)
 						unsigned char b[8];
 					} x;
 
-					x.qw = *(uint64_t *)p;
+					memcpy(&x.qw, p, sizeof(x.qw));
 
 					if ((x.qw & 0x8080808080808080))
 						break;
-- 
2.52.0