diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h index 2b1f0543d..bec8dd345 100644 --- a/src/common/windows/nt.h +++ b/src/common/windows/nt.h @@ -634,7 +634,9 @@ static inline uint64_t ffKSystemTimeToUInt64(const volatile KSYSTEM_TIME* pTime) { #if _WIN64 - return *(uint64_t*) pTime; + // This is safe even if pTime is not 8-byte aligned + // See https://learn.microsoft.com/en-us/windows/win32/winprog64/fault-alignments + return *(const volatile uint64_t*) pTime; #else diff --git a/src/detection/uptime/uptime_windows.c b/src/detection/uptime/uptime_windows.c index c5a4d423f..8ac7b3dc5 100644 --- a/src/detection/uptime/uptime_windows.c +++ b/src/detection/uptime/uptime_windows.c @@ -4,7 +4,7 @@ const char* ffDetectUptime(FFUptimeResult* result) { - // GetInterruptTime with Win7 support + // QueryInterruptTime with Win7 support uint64_t interruptTime = ffKSystemTimeToUInt64(&SharedUserData->InterruptTime); result->uptime = interruptTime / 10000; // Convert from 100-nanosecond intervals to milliseconds