Using HMAC ()'s facility of returning the digest in a static array is
not thread safe (this can't be fixed) and it is not portable to the
OpenSSL forks: BoringSSL removed support for this a decade ago (so
aws-lc doesn't support it either) and LibreSSL followed a few years
back.
There is no downside to having a 32-byte array on the stack and it would
make zoitechat safe to use from other forks without the need of patching
it.
Add an error check for the HMAC () call and handle the error in the
caller.
master's new xtext_tests target compiles xtext.c on its own with only
GTK linked, so hexcolor_parse cannot live in util.c. Keep it in a
dependency-free hexcolor.c that both test targets compile, and register
it in the Visual Studio project for the Windows build.
Claude-Session: https://claude.ai/code/session_01Jxd4AknGzdAENADWAGHCzx
Added a Windows-specific guard in waitline() that checks _get_osfhandle(sok) before calling read() in non-socket mode; if the CRT file descriptor is invalid, it now fails gracefully with -1 instead of hitting the debug CRT assertion you reported.
Also cast the check of "inet_addr" to guint32. The POSIX declaration
of this function returns in_addr_t which is the same as uint32_t.
Windows does not define this type and instead uses unsigned long.
If n becomes 0 at the same time that the end of either s1 or s2 are
reached, the next iteration of the while loop wouldn't happen, so we
wouldn't correctly return 0.
rfc_casecmp was broken because reaching terminator for str1 was used as
a terminal condition and str2 may be shorter than str1, resulting in an
oob read condition for str2.
rfc_ncasecmp was broken because it checked if n characters were checked
or if BOTH pointers reached their terminator, however the strings may
be different lengths and also less than n characters in length, meaning
that they don't both reach their terminators at the same time,
resulting in an oob read condition.
Quick rundown of benefits:
- Much faster:
- Autotools (with autogen): 22 seconds
- Meson: 7 seconds
- Meson (with ccache): 2 seconds
- Simpler:
- ~1000 lines smaller
- Single simple language
- Potentially better Windows (Visual Studio) support
What is not done:
- Complete Windows support
- OSX support (easy)
Closes#2013Closes#1937Closes#1803
- AES and Blowfish mechanisms are deemed insecure and servers
have removed support for them
- Remove attempts to retry since we only support one mech
- Handle SASL 3.2's new syntax for supported mechs
- Removes need to check for malloc failure
- Removes need for NULL checks on free
- Adds checks for integer overflows
- Removes some extra memset calls
- Removes chance of mixing libc and glib malloc/free
Theo Buehler
BareMetal
deepend
Collin Funk
Sadie Powell
Joseph Bisch
Patrick Griffis
Erik de Castro Lopo
Arnavion
Berke Viktor
TingPing
Campbell Barton
Diogo Sousa