From 8455d6f6cd43b7b143ab9ee19437452fceba9cc9 Mon Sep 17 00:00:00 2001
From: Jakub Jelinek <jakub@redhat.com>
Date: Wed, 3 Apr 2024 10:02:35 +0200
Subject: [PATCH] libquadmath: Don't assume the storage for __float128
 arguments is aligned [PR114533]

With the register_printf_type/register_printf_modifier/register_printf_specifier
APIs the C library is just told the size of the argument and is provided with
a callback to fetch the argument from va_list using va_arg into C library provided
memory.  The C library isn't told what alignment requirement it has, but we were
using direct load of a __float128 value from that memory which assumes
__alignof (__float128) alignment.

The following patch fixes that by using memcpy instead.

I haven't been able to reproduce an actual crash, tried
 #include <quadmath.h>
 #include <stdlib.h>
 #include <stdio.h>

int main ()
{
  __float128 r;
  int prec = 20;
  int width = 46;
  char buf[128];

  r = 2.0q;
  r = sqrtq (r);
  int n = quadmath_snprintf (buf, sizeof buf, "%+-#*.20Qe", width, r);
  if ((size_t) n < sizeof buf)
    printf ("%s\n", buf);
    /* Prints: +1.41421356237309504880e+00 */
  quadmath_snprintf (buf, sizeof buf, "%Qa", r);
  if ((size_t) n < sizeof buf)
    printf ("%s\n", buf);
    /* Prints: 0x1.6a09e667f3bcc908b2fb1366ea96p+0 */
  n = quadmath_snprintf (NULL, 0, "%+-#46.*Qe", prec, r);
  if (n > -1)
    {
      char *str = malloc (n + 1);
      if (str)
        {
          quadmath_snprintf (str, n + 1, "%+-#46.*Qe", prec, r);
          printf ("%s\n", str);
          /* Prints: +1.41421356237309504880e+00 */
        }
      free (str);
    }
  printf ("%+-#*.20Qe\n", width, r);
  printf ("%Qa\n", r);
  printf ("%+-#46.*Qe\n", prec, r);
  printf ("%d %Qe %d %Qe %d %Qe\n", 1, r, 2, r, 3, r);
  return 0;
}
In any case, I think memcpy for loading from it is right.

2024-04-03  Simon Chopin  <simon.chopin@canonical.com>
	    Jakub Jelinek  <jakub@redhat.com>

	PR libquadmath/114533
	* printf/printf_fp.c (__quadmath_printf_fp): Use memcpy to copy
	__float128 out of args.
	* printf/printf_fphex.c (__quadmath_printf_fphex): Likewise.

Signed-off-by: Simon Chopin <simon.chopin@canonical.com>
---
 libquadmath/printf/printf_fp.c    | 2 +-
 libquadmath/printf/printf_fphex.c | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/libquadmath/printf/printf_fp.c b/libquadmath/printf/printf_fp.c
index 8effcee88fa..9968aa5307c 100644
--- a/libquadmath/printf/printf_fp.c
+++ b/libquadmath/printf/printf_fp.c
@@ -363,7 +363,7 @@ __quadmath_printf_fp (struct __quadmath_printf_file *fp,
 
   /* Fetch the argument value.	*/
     {
-      fpnum = **(const __float128 **) args[0];
+      memcpy (&fpnum, *(const void *const *) args[0], sizeof (fpnum));
 
       /* Check for special values: not a number or infinity.  */
       if (isnanq (fpnum))
diff --git a/libquadmath/printf/printf_fphex.c b/libquadmath/printf/printf_fphex.c
index a40a6b00945..ddb413563c6 100644
--- a/libquadmath/printf/printf_fphex.c
+++ b/libquadmath/printf/printf_fphex.c
@@ -163,7 +163,8 @@ __quadmath_printf_fphex (struct __quadmath_printf_file *fp,
 
   /* Fetch the argument value.	*/
     {
-      fpnum.value = **(const __float128 **) args[0];
+      memcpy (&fpnum.value, *(const void *const *) args[0],
+	      sizeof (fpnum.value));
 
       /* Check for special values: not a number or infinity.  */
       if (isnanq (fpnum.value))