Load of misaligned address in yh_util_import_wrapped()

[invd]

During fuzzing, I've found the following with -fsanitize=undefined:

runtime error: load of misaligned address 0x7b025caee261 for type 'uint16_t' (aka 'unsigned short'), which requires 2 byte alignment

at the code position in yh_util_import_wrapped():

yubihsm-shell/lib/yubihsm.c

Line 2738 in c409285

*target_id = ntohs(*((uint16_t *) (response + 1)));

This is undefined behavior (UB) and therefore a bug.

yh_util_import_rsa_wrapped() appears to have a second instance of this pattern that is also triggered:

yubihsm-shell/lib/yubihsm.c

Line 2797 in c409285

*target_id = ntohs(*((uint16_t *) (response + 1)));