Merge pull request #548 from dwrensha/ubsan-packed-alignment

buffers passed to PackedOutputStream::write() must be word-aligned

c++/src/capnp/serialize-packed-test.c++

@@ -86,10 +86,16 @@ private:
   std::string::size_type readPos;
 };
 
-void expectPacksTo(kj::ArrayPtr<const byte> unpacked, kj::ArrayPtr<const byte> packed) {
+void expectPacksTo(kj::ArrayPtr<const byte> unpackedUnaligned, kj::ArrayPtr<const byte> packed) {
   TestPipe pipe;
 
-  EXPECT_EQ(unpacked.size(), computeUnpackedSizeInWords(packed) * sizeof(word));
+  auto unpackedSizeInWords = computeUnpackedSizeInWords(packed);
+  EXPECT_EQ(unpackedUnaligned.size(), unpackedSizeInWords * sizeof(word));
+
+  // Make a guaranteed-to-be-aligned copy of the unpacked buffer.
+  kj::Array<word> unpackedWords = kj::heapArray<word>(unpackedSizeInWords);
+  memcpy(unpackedWords.begin(), unpackedUnaligned.begin(), unpackedUnaligned.size());
+  kj::ArrayPtr<const byte> unpacked = unpackedWords.asBytes();
 
   // -----------------------------------------------------------------
   // write

c++/src/capnp/serialize-packed.c++

@@ -351,7 +351,8 @@ void PackedOutputStream::write(const void* src, size_t size) {
       // An all-zero word is followed by a count of consecutive zero words (not including the
       // first one).
 
-      // We can check a whole word at a time.
+      // We can check a whole word at a time. (Here is where we use the assumption that
+      // `src` is word-aligned.)
       const uint64_t* inWord = reinterpret_cast<const uint64_t*>(in);
 
       // The count must fit it 1 byte, so limit to 255 words.

c++/src/capnp/serialize-packed.h

@@ -50,6 +50,7 @@ private:
 };
 
 class PackedOutputStream: public kj::OutputStream {
+  // An output stream that packs data. Buffers passed to `write()` must be word-aligned.
 public:
   explicit PackedOutputStream(kj::BufferedOutputStream& inner);
   KJ_DISALLOW_COPY(PackedOutputStream);