Skip to content

Releases: lowerpower/SainSmartUsbRelay

Release list

Cleanup Release

Choose a tag to compare

@lowerpower lowerpower released this 18 Feb 20:18

Title: v1.0 — Full Code Audit & Bug Fix Release

Body:

Summary

Complete security and correctness audit of the entire codebase. 66 issues identified and resolved across src/, console2udp/, build scripts, and documentation.

| Severity | Count | Status    |
 |----------|-------|-----------|
 | Critical | 7     | All fixed |
 | High     | 14    | All fixed |
 | Medium   | 20    | All fixed |
 | Low      | 8     | All fixed |

Highlights

  • Checksum calculation was broken — only used last byte instead of additive sum
  • Buffer underflow in padd_set_string() wrote before buffer start
  • Signal handler called non-async-safe functions like printf and syslog
  • Format string crash — printf("%s", int_value) segfault in MTU test
  • Inverted strcmp logic caused HTTP response parsing to reject valid responses
  • Stack overflow in curl_get via unbounded sprintf/strcat chain
  • Shell script infinite recursion — kill() called itself instead of system kill
  • Compiler hardening flags added
  • Hold time arithmetic guarded against U32 wraparound

See https://github.com/lowerpower/SainSmartUsbRelay/blob/master/CHANGELOG.md for the complete fix list.