Fix: issue #112 follow-ups — OTR strip, presence UAF, OMEMO load #130
Reference in New Issue
Block a user
No description provided.
Delete Branch "fix/issue-112-followups"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Correctness / safety fixes
tag_lengthbytes; previously the body was duplicated for messages longer than the tag.resourcefields beforeconnection_add_available_resource()takes ownership, removing a latent use-after-free in the own-presence path._omemo_finalize_identity_loadfailure on connect (log +cons_show_error+ stop) instead of leaving OMEMO silently unavailable.urn:xmpp:sid:0(checks thebyJID or its domain, since that's what profanity disco's on connect); falls back to no-dedup when caps are unknown. Covered by two functional tests (trusted vs untrusted server).[ ] \n \r);=and#are valid there and stay, keeping read/write symmetric.Build hardening (item 5) — Pikaur-safe
Re-introduces what
5459e78e8attempted, in a form that coexists with Arch/Pikaur (the conflict that forced its revert in0722dc9e3):-D_FORTIFY_SOURCE=2only when env ($CFLAGS/$CPPFLAGS) doesn't already set one and not under--coverage.-isystem.--enable-sanitizers(ASan+UBSan;unsigned-integer-overflowprobed, skipped on gcc), off by default.--enable-hardeninggates-Wnull-dereference, off by default.-Wsign-comparepromoted from-Wno-to an active probed warning.Plus the sign-conversion sites that surfaced as safe (pointer-diff →
gsizevia newg_diff_to_gsizehelper, non-negative casts), and/vcard removenow validates its index throughstrtoi_rangeso a negative argument can't become a huge unsigned index.Verified: default Debian build,
--enable-sanitizersbuild, and an Arch build with/etc/makepkg.confinjected (Pikaur simulation) — all green, including the functional-test and unit-test binaries.Out of scope / tracked separately
_migrate_to_v3dedupe/FK) → #128, PR #129.-Wconversioncleanup (~180 mostly-mechanical sign-conversion sites) — deferred; not enabled here because it would block-Werrorbuilds.Items 4 and 6 were resolved by investigation (no code change needed).
Refs #112
Fixes #112
Fixes #109
WIP: Fix: issue #112 follow-ups — OTR strip, presence UAF, OMEMO loadto Fix: issue #112 follow-ups — OTR strip, presence UAF, OMEMO loadGenerally this PR introduces nice improvements. However, I'd like to discuss further the nature of multiple changes to ensure their necessity and alignment with our goals. Nonetheless, the PR is good in its nature, as well as documentation and level of detail.
@@ -10068,0 +10066,4 @@int index;auto_gchar gchar* err_msg = NULL;if (!strtoi_range(args[1], &index, 0, INT_MAX, &err_msg)) {cons_show("%s", err_msg);I think that
cons_show_errorwould be more appropriate.@@ -692,12 +692,13 @@ get_file_paths_recursive(const char* path, GSList** contents)gchar*get_random_string(int length){g_assert(length >= 0);g_assertusage should be discussed.@@ -161,0 +163,4 @@static inline gsizeg_diff_to_gsize(const void* end, const void* start){g_assert(end >= start);That does not appear as an appropriate solution. In debug mode it would crash the app, while in prod it would be ignored. Both ways introduce additional point of failure, further discussion is needed.
@@ -279,3 +279,3 @@tag_length = 32;}memmove(whitespace_base, whitespace_base + tag_length, tag_length);// Shift the remainder of the message (including the trailing NUL)The comment explains the nature of change, which is a known antipattern.
@@ -622,3 +622,3 @@if (g_strcmp0(xmpp_presence->jid->barejid, my_jid->barejid) == 0) {connection_add_available_resource(resource);// Snapshot everything we read from `resource` before ownership isnit: Ideally we want more concise 1-2 line comments instead. Further discussion is other required.
@@ -120,3 +120,3 @@_mkdir_recursive(const char* dir){int i;size_t i;Why is it even defined out of loop scope? We can move it inside of the
forbody for readability.Adsorb #107
d1dfd57a49tof63bf57872LGTM
Suggested squash comment