Releases: lowerpower/SainSmartUsbRelay
Releases · lowerpower/SainSmartUsbRelay
Release list
Cleanup Release
Title: v1.0 — Full Code Audit & Bug Fix Release
Body:
Summary
Complete security and correctness audit of the entire codebase. 66 issues identified and resolved across src/, console2udp/, build scripts, and documentation.
| Severity | Count | Status |
|----------|-------|-----------|
| Critical | 7 | All fixed |
| High | 14 | All fixed |
| Medium | 20 | All fixed |
| Low | 8 | All fixed |
Highlights
- Checksum calculation was broken — only used last byte instead of additive sum
- Buffer underflow in padd_set_string() wrote before buffer start
- Signal handler called non-async-safe functions like printf and syslog
- Format string crash — printf("%s", int_value) segfault in MTU test
- Inverted strcmp logic caused HTTP response parsing to reject valid responses
- Stack overflow in curl_get via unbounded sprintf/strcat chain
- Shell script infinite recursion — kill() called itself instead of system kill
- Compiler hardening flags added
- Hold time arithmetic guarded against U32 wraparound
See https://github.com/lowerpower/SainSmartUsbRelay/blob/master/CHANGELOG.md for the complete fix list.