fix misaligned access when reading PKCS#11 attributes

CK_ATTRIBUTE.pValue pointers are not guaranteed to be naturally aligned.
Direct casts (`*(CK_KEY_TYPE*)pValue`, `*(CK_BBOOL*)pValue`, etc.)
trigger undefined behavior.

Security impact: partials read from adjacent memory or DoS

Fixed by using `memcpy()` in all attribute parsing paths (extractObjectInformation,
C_CopyObject, C_FindObjectsInit).

Signed-off-by: Shawn C <citypw@hardenedlinux.org>

Author: citypw

src/lib/SoftHSM.cpp

@@ -247,29 +247,33 @@ static CK_RV extractObjectInformation(CK_ATTRIBUTE_PTR pTemplate,
 				}
 				break;
 			case CKA_KEY_TYPE:
-				if (pTemplate[i].ulValueLen == sizeof(CK_KEY_TYPE))
+				if (pTemplate[i].ulValueLen == sizeof(CK_KEY_TYPE) &&
+				    pTemplate[i].pValue != NULL_PTR)
 				{
-					keyType = *(CK_KEY_TYPE*)pTemplate[i].pValue;
+					memcpy(&keyType, pTemplate[i].pValue, sizeof(keyType));
 					bHasKeyType = true;
 				}
 				break;
 			case CKA_CERTIFICATE_TYPE:
-				if (pTemplate[i].ulValueLen == sizeof(CK_CERTIFICATE_TYPE))
+				if (pTemplate[i].ulValueLen == sizeof(CK_CERTIFICATE_TYPE) &&
+				    pTemplate[i].pValue != NULL_PTR)
 				{
-					certType = *(CK_CERTIFICATE_TYPE*)pTemplate[i].pValue;
+					memcpy(&certType, pTemplate[i].pValue, sizeof(certType));
 					bHasCertType = true;
 				}
 				break;
 			case CKA_TOKEN:
-				if (pTemplate[i].ulValueLen == sizeof(CK_BBOOL))
+				if (pTemplate[i].ulValueLen == sizeof(CK_BBOOL) &&
+				    pTemplate[i].pValue != NULL_PTR)
 				{
-					isOnToken = *(CK_BBOOL*)pTemplate[i].pValue;
+					memcpy(&isOnToken, pTemplate[i].pValue, sizeof(isOnToken));
 				}
 				break;
 			case CKA_PRIVATE:
-				if (pTemplate[i].ulValueLen == sizeof(CK_BBOOL))
+				if (pTemplate[i].ulValueLen == sizeof(CK_BBOOL) &&
+				    pTemplate[i].pValue != NULL_PTR)
 				{
-					isPrivate = *(CK_BBOOL*)pTemplate[i].pValue;
+					memcpy(&isPrivate, pTemplate[i].pValue, sizeof(isPrivate));
 					bHasPrivate = true;
 				}
 				break;
@@ -1711,14 +1715,16 @@ CK_RV SoftHSM::C_CopyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject
 
 	for (CK_ULONG i = 0; i < ulCount; i++)
 	{
-		if ((pTemplate[i].type == CKA_TOKEN) && (pTemplate[i].ulValueLen == sizeof(CK_BBOOL)))
+		if ((pTemplate[i].type == CKA_TOKEN) && (pTemplate[i].ulValueLen == sizeof(CK_BBOOL)) &&
+		    (pTemplate[i].pValue != NULL_PTR))
 		{
-			isOnToken = *(CK_BBOOL*)pTemplate[i].pValue;
+			memcpy(&isOnToken, pTemplate[i].pValue, sizeof(isOnToken));
 			continue;
 		}
-		if ((pTemplate[i].type == CKA_PRIVATE) && (pTemplate[i].ulValueLen == sizeof(CK_BBOOL)))
+		if ((pTemplate[i].type == CKA_PRIVATE) && (pTemplate[i].ulValueLen == sizeof(CK_BBOOL)) &&
+		    (pTemplate[i].pValue != NULL_PTR))
 		{
-			isPrivate = *(CK_BBOOL*)pTemplate[i].pValue;
+			memcpy(&isPrivate, pTemplate[i].pValue, sizeof(isPrivate));
 			continue;
 		}
 	}
@@ -2080,9 +2086,12 @@ CK_RV SoftHSM::C_FindObjectsInit(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pT
 
 			if (attr.isBooleanAttribute())
 			{
-				if (sizeof(CK_BBOOL) != pTemplate[i].ulValueLen)
+				if (sizeof(CK_BBOOL) != pTemplate[i].ulValueLen ||
+				    pTemplate[i].pValue == NULL_PTR)
 					break;
-				bool bTemplateValue = (*(CK_BBOOL*)pTemplate[i].pValue == CK_TRUE);
+				CK_BBOOL b = CK_FALSE;
+				memcpy(&b, pTemplate[i].pValue, sizeof(b));
+				bool bTemplateValue = (b == CK_TRUE);
 				if (attr.getBooleanValue() != bTemplateValue)
 					break;
 			}