[PATCH v2] expand: fix SIGBUS due to unaligned access

[PATCH v2] expand: fix SIGBUS due to unaligned access

[Natanael Copa]

Replace direct uint64_t dereference with memcpy() to avoid
SIGBUS on armv7 when p is not 8-byte aligned.

Fixes crashes in dash during IFS splitting on strict-alignment
architectures.

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
---
 src/expand.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

v2:
- Added a couple more instances of unaligned access.

diff --git a/src/expand.c b/src/expand.c
index 8c8bf0e..98b65ba 100644
--- a/src/expand.c
+++ b/src/expand.c
@@ -961,13 +961,14 @@ static size_t memtodest(const char *p, size_t len, int flags)
 	if (likely(!(flags & (expq >> 3 | expq >> 4 | expq >> 8) &
 		     (QUOTES_ESC | EXP_MBCHAR)))) {
 		while (len >= 8) {
-			uint64_t x = *(uint64_t *)(p + count);
+			uint64_t x;
+			memcpy(&x, p + count, sizeof(x));
 
 			if ((x | (x - 0x0101010101010101)) &
 			    0x8080808080808080)
 				break;
 
-			*(uint64_t *)(q + count) = x;
+			memcpy(q + count, &x, sizeof(x));
 
 			count += 8;
 			len -= 8;
@@ -1335,7 +1336,7 @@ ifsbreakup(char *string, int maxargs, struct arglist *arglist)
 						unsigned char b[8];
 					} x;
 
-					x.qw = *(uint64_t *)p;
+					memcpy(&x.qw, p, sizeof(x.qw));
 
 					if ((x.qw & 0x8080808080808080))
 						break;
-- 
2.52.0

Re: [PATCH v2] expand: fix SIGBUS due to unaligned access

[tiagodepalves]

On Fri, 16 Jan, 2026 at 09:55:39PM +0100, Natanael Copa wrote:
> Replace direct uint64_t dereference with memcpy() to avoid
> SIGBUS on armv7 when p is not 8-byte aligned.
>
> Fixes crashes in dash during IFS splitting on strict-alignment
> architectures.

Hi, just wanted to mention that the issue also affects x86-64 when
compiled with '-march=x86-64-v2 -O3' (requires both), causing dash
to crash constantly. It would probably affect distros that provide
binaries for microarchitecture revisions, like CachyOS [1] if they
had upgraded dash.

In any case, your patch fixes the issue for me, even when compiling
with '-march=native -mtune=native -O3' on AMD Zen 4. Thanks!

[1]: https://packages.cachyos.org/package/cachyos-core-v4/x86_64/dash

Re: [PATCH v2] expand: fix SIGBUS due to unaligned access

[Herbert Xu]

Natanael Copa <ncopa@alpinelinux.org> wrote:
> Replace direct uint64_t dereference with memcpy() to avoid
> SIGBUS on armv7 when p is not 8-byte aligned.
> 
> Fixes crashes in dash during IFS splitting on strict-alignment
> architectures.
> 
> Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
> ---
> src/expand.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
> 
> v2:
> - Added a couple more instances of unaligned access.

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt