ubsan fixes

openair3/NAS/COMMON/EMM/MSG/FGSUplinkNasTransport.c

@@ -55,9 +55,11 @@ int encode_fgs_payload_container(FGSPayloadContainer *paycontainer, uint8_t iei,
     encoded += encode_result;
   }
   if(iei > 0){
-    *(uint16_t*) (buffer+1) = htons(encoded - 3);
+    uint16_t tmp = htons(encoded - 3);
+    memcpy(buffer + 1, &tmp, sizeof(tmp));
   } else {
-    *(uint16_t*) (buffer) = htons(encoded - 2);
+    uint16_t tmp = htons(encoded - 2);
+    memcpy(buffer, &tmp, sizeof(tmp));
   }
 
   return encoded;

openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c

@@ -35,14 +35,18 @@ void capture_pdu_session_establishment_accept_msg(uint8_t *buffer, uint32_t msg_
   pdu_session_establishment_accept_msg_t psea_msg;
   sec_nas_hdr.epd = *(buffer + (offset++));
   sec_nas_hdr.sht = *(buffer + (offset++));
-  sec_nas_hdr.mac = htonl(*(uint32_t *)(buffer + offset));
+  uint32_t tmp;
+  memcpy(&tmp, buffer + offset, sizeof(tmp));
+  sec_nas_hdr.mac = htonl(tmp);
   offset+=sizeof(sec_nas_hdr.mac);
   sec_nas_hdr.sqn = *(buffer + (offset++));
   sec_nas_msg.epd          = *(buffer + (offset++));
   sec_nas_msg.sht          = *(buffer + (offset++));
   sec_nas_msg.msg_type     = *(buffer + (offset++));
   sec_nas_msg.payload_type = *(buffer + (offset++));
-  sec_nas_msg.payload_len  = htons(*(uint16_t *)(buffer + offset));
+  uint16_t tmp16;
+  memcpy(&tmp16, buffer + offset, sizeof(tmp16));
+  sec_nas_msg.payload_len = htons(tmp16);
   offset+=sizeof(sec_nas_msg.payload_len);
   /* Mandatory Presence IEs */
   psea_msg.epd      = *(buffer + (offset++));
@@ -51,12 +55,14 @@ void capture_pdu_session_establishment_accept_msg(uint8_t *buffer, uint32_t msg_
   psea_msg.msg_type = *(buffer + (offset++));
   psea_msg.pdu_type = *(buffer + offset) & 0x0f;
   psea_msg.ssc_mode = (*(buffer + (offset++)) & 0xf0) >> 4;
-  psea_msg.qos_rules.length = htons(*(uint16_t *)(buffer + offset));
+  memcpy(&tmp16, buffer + offset, sizeof(tmp16));
+  psea_msg.qos_rules.length = htons(tmp16);
   offset+=sizeof(psea_msg.qos_rules.length);
   /* Supports the capture of only one QoS Rule, it should be changed for multiple QoS Rules */
   qos_rule_t qos_rule;
   qos_rule.id     =  *(buffer + (offset++));
-  qos_rule.length = htons(*(uint16_t *)(buffer + offset));
+  memcpy(&tmp16, buffer + offset, sizeof(tmp16));
+  qos_rule.length = htons(tmp16);
   offset+=sizeof(qos_rule.length);
   qos_rule.oc     = (*(buffer + offset) & 0xE0) >> 5;
   qos_rule.dqr    = (*(buffer + offset) & 0x10) >> 4;

openair3/NAS/COMMON/IES/FGCNasMessageContainer.c

@@ -76,7 +76,8 @@ int encode_fgc_nas_message_container(FGCNasMessageContainer *nasmessagecontainer
   if ((encode_result = encode_octet_string(&nasmessagecontainer->nasmessagecontainercontents, buffer + encoded, len - encoded)) < 0) {
     return encode_result;
   } else {
-    *(uint16_t*) (buffer+1) = htons(encoded + encode_result - 3);
+    uint16_t tmp = htons(encoded + encode_result - 3);
+    memcpy(buffer + 1, &tmp, sizeof(tmp));
     encoded += encode_result;
   }
 

openair3/NAS/COMMON/IES/FGSMobileIdentity.c

@@ -53,8 +53,9 @@ int decode_5gs_mobile_identity(FGSMobileIdentity *fgsmobileidentity, uint8_t iei
     CHECK_IEI_DECODER(iei, *buffer);
     decoded++;
   }
-
-  ielen = *(uint16_t*)(buffer + decoded);  /* length is two bytes */
+  uint16_t tmp;
+  memcpy(&tmp, buffer + decoded, sizeof(tmp));
+  ielen = (uint8_t)tmp;
   decoded += 2;
   CHECK_LENGTH_DECODER(len - decoded, ielen);
 
@@ -106,9 +107,11 @@ int encode_5gs_mobile_identity(FGSMobileIdentity *fgsmobileidentity, uint8_t iei
   }
 
   if(iei > 0){
-    *(uint16_t*) (buffer+1) = htons(encoded  + encoded_rc - 3);
+    uint16_t tmp = htons(encoded + encoded_rc - 3);
+    memcpy(buffer + 1, &tmp, sizeof(tmp));
   } else {
-    *(uint16_t*) buffer = htons(encoded  + encoded_rc - 2);
+    uint16_t tmp = htons(encoded + encoded_rc - 2);
+    memcpy(buffer, &tmp, sizeof(tmp));
   }
 
   return (encoded + encoded_rc);

openair3/NAS/COMMON/UTIL/TLVDecoder.h

@@ -41,9 +41,13 @@
     vALUE = ntohl(*(uint32_t*)(bUFFER)) >> 8; \
     sIZE += sizeof(uint8_t) + sizeof(uint16_t)
 
-#define DECODE_U32(bUFFER, vALUE, sIZE)   \
-    vALUE = ntohl(*(uint32_t*)(bUFFER));  \
-    sIZE += sizeof(uint32_t)
+#define DECODE_U32(bUFFER, vALUE, sIZE) \
+  {                                     \
+    uint32_t v;                         \
+    memcpy(&v, bUFFER, sizeof(v));      \
+    vALUE = ntohl(v);                   \
+  }                                     \
+  sIZE += sizeof(uint32_t)
 
 #if (BYTE_ORDER == LITTLE_ENDIAN)
 # define DECODE_LENGTH_U16(bUFFER, vALUE, sIZE)          \

openair3/NAS/COMMON/UTIL/TLVEncoder.h

@@ -36,9 +36,12 @@
     *(uint32_t*)(buffer) = htonl(value);  \
     size += sizeof(uint8_t) + sizeof(uint16_t)
 
-#define ENCODE_U32(buffer, value, size)   \
-    *(uint32_t*)(buffer) = htonl(value);  \
-    size += sizeof(uint32_t)
+#define ENCODE_U32(buffer, value, size) \
+  {                                     \
+    uint32_t tmp = htonl(value);        \
+    memcpy(buffer, &tmp, sizeof(tmp));  \
+  }                                     \
+  size += sizeof(uint32_t)
 
 #define IES_ENCODE_U8(buffer, encoded, value)   \
     ENCODE_U8(buffer + encoded, value, encoded)

openair3/NAS/NR_UE/nr_nas_msg_sim.c

@@ -883,7 +883,9 @@ uint8_t get_msg_type(uint8_t *pdu_buffer, uint32_t length) {
         msg_type = ((mm_msg_header_t *)(pdu_buffer + offset))->message_type;
 
         if (msg_type == FGS_DOWNLINK_NAS_TRANSPORT) {
-          msg_type = ((dl_nas_transport_t *)(pdu_buffer+ offset))->sm_nas_msg_header.message_type;
+          dl_nas_transport_t tmp;
+          memcpy(&tmp, pdu_buffer + offset, sizeof(tmp));
+          msg_type = tmp.sm_nas_msg_header.message_type;
         }
       }
     } else { // plain 5GS NAS message