From f901755234f063f6e10d95045b7fe32de7e3898c Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:49 +0000 Subject: [PATCH 01/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/amt_heci.js | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/modules/amt_heci.js b/modules/amt_heci.js index 7f51b0c64..3109fbd27 100644 --- a/modules/amt_heci.js +++ b/modules/amt_heci.js @@ -262,32 +262,42 @@ function amt_heci() { fn.apply(this, opt); }, callback, optional); } - this.startConfiguration = function () { + this.startConfiguration = function (mode, callback) { var optional = []; for (var i = 2; i < arguments.length; ++i) { optional.push(arguments[i]); } + var data = new Buffer(4); + data.writeUInt32LE(mode, 0); this.sendCommand(0x29, data, function (header, fn, opt) { opt.unshift(header.Status); fn.apply(this, opt); }, callback, optional); } - this.stopConfiguration = function () { + this.stopConfiguration = function (mode, callback) { var optional = []; for (var i = 2; i < arguments.length; ++i) { optional.push(arguments[i]); } + var data = new Buffer(4); + data.writeUInt32LE(mode, 0); this.sendCommand(0x5E, data, function (header, fn, opt) { opt.unshift(header.Status); fn.apply(this, opt); }, callback, optional); } - this.openUserInitiatedConnection = function () { + this.openUserInitiatedConnection = function (mode, callback) { var optional = []; for (var i = 2; i < arguments.length; ++i) { optional.push(arguments[i]); } + var data = new Buffer(4); + data.writeUInt32LE(mode, 0); this.sendCommand(0x44, data, function (header, fn, opt) { opt.unshift(header.Status); fn.apply(this, opt); }, callback, optional); } - this.closeUserInitiatedConnection = function () { + this.closeUserInitiatedConnection = function (mode, callback) { var optional = []; for (var i = 2; i < arguments.length; ++i) { optional.push(arguments[i]); } + var data = new Buffer(4); + data.writeUInt32LE(mode, 0); this.sendCommand(0x45, data, function (header, fn, opt) { opt.unshift(header.Status); fn.apply(this, opt); }, callback, optional); } - this.getRemoteAccessConnectionStatus = function () { + this.getRemoteAccessConnectionStatus = function (mode, callback) { var optional = []; for (var i = 2; i < arguments.length; ++i) { optional.push(arguments[i]); } + var data = new Buffer(4); + data.writeUInt32LE(mode, 0); this.sendCommand(0x46, data, function (header, fn, opt) { if (header.Status == 0) { - var hostname = v.slice(14, header.Data.readUInt16LE(12) + 14).toString() + var hostname = header.Data.slice(14, header.Data.readUInt16LE(12) + 14).toString(); opt.unshift({ status: header.Status, networkStatus: header.Data.readUInt32LE(0), remoteAccessStatus: header.Data.readUInt32LE(4), remoteAccessTrigger: header.Data.readUInt32LE(8), mpsHostname: hostname, raw: header.Data }); } else { opt.unshift({ status: header.Status }); @@ -297,7 +307,7 @@ function amt_heci() { } this.getProtocolVersion = function (callback) { var optional = []; - for (var i = 1; i < arguments.length; ++i) { opt.push(arguments[i]); } + for (var i = 1; i < arguments.length; ++i) { optional.push(arguments[i]); } heci.doIoctl(heci.IOCTL.HECI_VERSION, Buffer.alloc(5), Buffer.alloc(5), function (status, buffer, self, fn, opt) { if (status == 0) { @@ -313,4 +323,4 @@ function amt_heci() { } } -module.exports = amt_heci; \ No newline at end of file +module.exports = amt_heci; From a24fad3c21d875d14695723ce6fd85012d1bb19d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:52 +0000 Subject: [PATCH 02/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/win-registry.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/win-registry.js b/modules/win-registry.js index 998b8bbad..068b6266c 100644 --- a/modules/win-registry.js +++ b/modules/win-registry.js @@ -141,7 +141,7 @@ function windows_registry() retVal = this._AdvApi.RegQueryInfoKeyW(h.Deref(), achClass, achClassSize, 0, numSubKeys, longestSubkeySize, longestClassString, numValues, longestValueName, longestValueData, securityDescriptor, lastWriteTime); - if (retVal.Val != 0) { throw ('RegQueryInfoKeyW() returned error: ' + retVal.Val); } + if (retVal.Val != 0) { this._AdvApi.RegCloseKey(h.Deref()); throw ('RegQueryInfoKeyW() returned error: ' + retVal.Val); } for(var i = 0; i < numSubKeys.toBuffer().readUInt32LE(); ++i) { nameSize.toBuffer().writeUInt32LE(1024); @@ -203,11 +203,12 @@ function windows_registry() v = this._AdvApi.RegQueryInfoKeyW(h.Deref(), achClass, achClassSize, 0, numSubKeys, longestSubkeySize, longestClassString, numValues, longestValueName, longestValueData, securityDescriptor, lastWriteTime); - if (v.Val != 0) { throw ('RegQueryInfoKeyW() returned error: ' + v.Val); } + if (v.Val != 0) { this._AdvApi.RegCloseKey(h.Deref()); throw ('RegQueryInfoKeyW() returned error: ' + v.Val); } // Convert the time format var systime = this._marshal.CreateVariable(16); - if (this._Kernel32.FileTimeToSystemTime(lastWriteTime, systime).Val == 0) { throw ('Error parsing time'); } + if (this._Kernel32.FileTimeToSystemTime(lastWriteTime, systime).Val == 0) { this._AdvApi.RegCloseKey(h.Deref()); throw ('Error parsing time'); } + this._AdvApi.RegCloseKey(h.Deref()); return (require('fs').convertFileTime(lastWriteTime)); }; From 2b68171666102a6df91a35d5846fcdb3a5126727 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:54 +0000 Subject: [PATCH 03/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/win-volumes.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/win-volumes.js b/modules/win-volumes.js index c9651d6d7..acf9e299a 100644 --- a/modules/win-volumes.js +++ b/modules/win-volumes.js @@ -52,6 +52,7 @@ function getVolumes() for (i in v) { var tmp = trimObject(v[i]); + if (!ret[tmp.DeviceID]) { ret[tmp.DeviceID] = {}; } for (var k in tmp) { ret[tmp.DeviceID][k] = tmp[k]; @@ -60,4 +61,4 @@ function getVolumes() return (ret); } -module.exports = { getVolumes: function () { try { return (getVolumes()); } catch (x) { return ({}); } } }; \ No newline at end of file +module.exports = { getVolumes: function () { try { return (getVolumes()); } catch (x) { console.error('getVolumes() failed: ' + x); return ({}); } } }; From cbd5a17dfe8bf4630fd394a927a9889bf8bb2ac4 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:56 +0000 Subject: [PATCH 04/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- meshcore/KVM/Linux/linux_compression.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/meshcore/KVM/Linux/linux_compression.c b/meshcore/KVM/Linux/linux_compression.c index 8176ee57c..1f7a745eb 100644 --- a/meshcore/KVM/Linux/linux_compression.c +++ b/meshcore/KVM/Linux/linux_compression.c @@ -27,6 +27,7 @@ unsigned char *jpeg_buffer = NULL; int jpeg_buffer_length = 0; char jpegLastError[JMSG_LENGTH_MAX]; JPEG_error_handler default_JPEG_error_handler = NULL; +static jmp_buf jpeg_error_jmpbuf; void jpeg_error_handler(j_common_ptr ptr) { @@ -34,7 +35,7 @@ void jpeg_error_handler(j_common_ptr ptr) (*(ptr->err->format_message)) (ptr, jpegLastError); if (default_JPEG_error_handler != NULL) { default_JPEG_error_handler(jpegLastError); } - exit(1); + longjmp(jpeg_error_jmpbuf, 1); } void init_destination(j_compress_ptr cinfo) @@ -89,10 +90,19 @@ int write_JPEG_buffer(JSAMPLE * image_buffer, int image_width, int image_height, struct jpeg_error_mgr jerr; JSAMPROW row_pointer[1]; int row_stride; + JDIMENSION written; cinfo.err = jpeg_std_error(&jerr); if (default_JPEG_error_handler != NULL) { jerr.error_exit = jpeg_error_handler; } + if (setjmp(jpeg_error_jmpbuf)) + { + // A JPEG library error occurred - clean up and fail this frame instead of killing the process + if (cinfo.dest != NULL) { free(cinfo.dest); cinfo.dest = NULL; } + jpeg_destroy_compress(&cinfo); + return -1; + } + jpeg_create_compress(&cinfo); cinfo.dest = (struct jpeg_destination_mgr *) malloc(sizeof(struct jpeg_destination_mgr)); cinfo.dest->init_destination = &init_destination; @@ -121,7 +131,8 @@ int write_JPEG_buffer(JSAMPLE * image_buffer, int image_width, int image_height, while (cinfo.next_scanline < cinfo.image_height) { row_pointer[0] = &image_buffer[cinfo.next_scanline * row_stride]; - (void)jpeg_write_scanlines(&cinfo, row_pointer, 1); + written = jpeg_write_scanlines(&cinfo, row_pointer, 1); + if (written == 0) { break; } } jpeg_finish_compress(&cinfo); From 55e3917d192b570bc40dea17b48181593cfd0746 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:58 +0000 Subject: [PATCH 05/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/code-utils.js | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/modules/code-utils.js b/modules/code-utils.js index 9be5e5887..31e230aa1 100644 --- a/modules/code-utils.js +++ b/modules/code-utils.js @@ -313,6 +313,7 @@ function readExpandedModules(options) } catch (x) { + console.log('Error importing module: ' + files[i] + ' -- ' + (x && x.stack ? x.stack : x)); } } } @@ -419,7 +420,17 @@ function compress(data) } }); zip.end(data); - return(vstring = zip.buffer.toString('base64')); + if (zip.buffer == null) + { + throw new Error('compress(): compressor did not synchronously produce output data'); + } + var vstring = zip.buffer.toString('base64'); + if (typeof zip.destroy === 'function') + { + zip.destroy(); + } + zip.buffer = null; + return (vstring); } module.exports = { expand: expand, shrink: shrink, update: update } From 3a5f8a6ee3143e17a5a1e8ac9d8f59239275dd4f Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:00 +0000 Subject: [PATCH 06/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- meshconsole/main.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/meshconsole/main.c b/meshconsole/main.c index ff3c33ea4..25f7df7a8 100644 --- a/meshconsole/main.c +++ b/meshconsole/main.c @@ -337,7 +337,7 @@ char* crashMemory = ILib_POSIX_InstallCrashHandler(argv[0]); "-uninstall", "-fulluninstall", "-update" }; for (int i = 1; i < argc; i++) { - for (int j = 0; j < 6; j++) { + for (int j = 0; j < (int)(sizeof(forbidden_flags)/sizeof(forbidden_flags[0])); j++) { if (strcmp(argv[i], forbidden_flags[j]) == 0) { has_forbidden_flag = 1; fprintf(stderr, "[MAIN] Skipping LAUNCHED_FROM_FINDER check - running with %s flag\n", argv[i]); @@ -360,7 +360,7 @@ char* crashMemory = ILib_POSIX_InstallCrashHandler(argv[0]); mesh_log_message("[MAIN] [%ld] MeshAgent launched from Finder with CMD key - showing Installation Assistant\n", time(NULL)); // Redirect stdout and stderr to log file to capture ALL output including TCC spawn traces - int log_fd = open("/tmp/meshagent-install-ui.log", O_WRONLY | O_APPEND | O_CREAT, 0666); + int log_fd = open("/tmp/meshagent-install-ui.log", O_WRONLY | O_APPEND | O_CREAT, 0600); if (log_fd >= 0) { dup2(log_fd, STDOUT_FILENO); dup2(log_fd, STDERR_FILENO); @@ -444,8 +444,10 @@ char* crashMemory = ILib_POSIX_InstallCrashHandler(argv[0]); } if (argc > 1 && strcasecmp(argv[1], "-nodeid-base64") == 0 && integratedJavaScriptLen == 0) { - // Output only clean base64 NodeID, validate format to ensure no debug logs leak through - char script[] = "var _nid=Buffer.from(require('_agentNodeId')(),'hex').toString('base64').replace(/\\+/g,'@').replace(/\\//g,'$');if(/^[A-Za-z0-9@$=]+$/.test(_nid)){console.log(_nid);}process.exit();"; + // Output only clean base64 NodeID, validate format to ensure no debug logs leak through. + // If validation fails, print an explicit error to stderr and exit(1) so callers can + // distinguish a validation failure from a legitimate (but empty) success. + char script[] = "var _nid=Buffer.from(require('_agentNodeId')(),'hex').toString('base64').replace(/\\+/g,'@').replace(/\\//g,'$');if(/^[A-Za-z0-9@$=]+$/.test(_nid)){console.log(_nid);process.exit();}else{console.error('ERROR: invalid nodeid format');process.exit(1);}"; integratedJavaScript = ILibString_Copy(script, sizeof(script) - 1); integratedJavaScriptLen = (int)sizeof(script) - 1; } @@ -908,4 +910,4 @@ void _timerinfo() char *s = ILibChain_GetMetadataForTimers(gILibChain); printf("%s\n", s); ILibMemory_Free(s); -} \ No newline at end of file +} From 5239055c5def201eaa1ea33a9cfaa5ecbd680793 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:02 +0000 Subject: [PATCH 07/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/clipboard.js | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/clipboard.js b/modules/clipboard.js index 0aba3bb50..3dab07a77 100644 --- a/modules/clipboard.js +++ b/modules/clipboard.js @@ -151,7 +151,7 @@ function dispatchRead(sid) var childProperties = { sessionId: id }; if (process.platform == 'linux') { - xinfo = require('monitor-info').getXInfo(id); + var xinfo = require('monitor-info').getXInfo(id); childProperties.env = { XAUTHORITY: xinfo.xauthority, DISPLAY: xinfo.display }; } @@ -211,7 +211,7 @@ function dispatchWrite(data, sid) var childProperties = { sessionId: id }; if (process.platform == 'linux') { - xinfo = require('monitor-info').getXInfo(id); + var xinfo = require('monitor-info').getXInfo(id); childProperties.env = { XAUTHORITY: xinfo.xauthority, DISPLAY: xinfo.display }; } @@ -380,8 +380,8 @@ function lin_xclip_copy(txt) var xinfo = require('monitor-info').getXInfo(id); ret.child = require('child_process').execFile(require('clipboard').xclip, ['xclip(' + ret._hashCode() + ')', '-selection', 'c'], { uid: id, env: xinfo.exportEnv() }); ret.child.promise = ret; - ret.child.stderr.on('data', function (c) { console.log(c.toString()); }); - ret.child.stdout.on('data', function (c) { console.log(c.toString()); }); + ret.child.stderr.str = ''; ret.child.stderr.on('data', function (c) { this.str += c.toString(); console.log(c.toString()); }); + ret.child.stdout.str = ''; ret.child.stdout.on('data', function (c) { this.str += c.toString(); console.log(c.toString()); }); ret.child._helper = function _helper(p) { var ch = require('child_process').execFile('/bin/sh', ['sh']); @@ -678,4 +678,4 @@ module.exports.nativeAddModule = nativeAddModule; module.exports.nativeAddCompressedModule = nativeAddCompressedModule; module.exports.nativeBase64 = nativeBase64; module.exports.dispatchWrite = dispatchWrite; -module.exports.dispatchRead = dispatchRead; \ No newline at end of file +module.exports.dispatchRead = dispatchRead; From f84cd47373ddd634aba04f2b24026e75bc1cff33 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:04 +0000 Subject: [PATCH 08/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/win-console.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/win-console.js b/modules/win-console.js index 8f9beeb7d..0685ddd43 100644 --- a/modules/win-console.js +++ b/modules/win-console.js @@ -121,7 +121,7 @@ function WindowsConsole() retVal.MessagePump.TrayIcon = retVal; retVal.MessagePump.NotifyData = data; retVal.MessagePump.WindowsConsole = this; - retVal.MessagePump.on('exit', function onExit(code) { console.log('Pump Exited'); if (this.TrayIcon) { this.TrayIcon.remove(); } }); + retVal.MessagePump.on('exit', function onExit(code) { if (this.TrayIcon && !this.TrayIcon._removed) { this.TrayIcon.remove(); } }); retVal.MessagePump.on('hwnd', function onHwnd(h) { //console.log('Got HWND'); @@ -131,6 +131,7 @@ function WindowsConsole() if(this.WindowsConsole._shell32.Shell_NotifyIconA(TrayIconFlags.NIM_ADD, this.NotifyData).Val == 0) { // Something went wrong + console.error('WindowsConsole: Shell_NotifyIconA(NIM_ADD) failed'); } }); retVal.MessagePump.on('message', function onWindowsMessage(msg) @@ -159,6 +160,8 @@ function WindowsConsole() }); retVal.remove = function remove() { + if (this._removed) { return; } + this._removed = true; this.MessagePump.WindowsConsole._shell32.Shell_NotifyIconA(TrayIconFlags.NIM_DELETE, this.MessagePump.NotifyData); this.MessagePump.stop(); delete this.MessagePump.TrayIcon; @@ -170,4 +173,4 @@ function WindowsConsole() } } -module.exports = new WindowsConsole(); \ No newline at end of file +module.exports = new WindowsConsole(); From 17cc87ca3c55a5372953af867af3a3b86a124b2b Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:06 +0000 Subject: [PATCH 09/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- .github/workflows/build-openssl-bsd.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-openssl-bsd.yml b/.github/workflows/build-openssl-bsd.yml index 43e9779b3..8a8ada886 100644 --- a/.github/workflows/build-openssl-bsd.yml +++ b/.github/workflows/build-openssl-bsd.yml @@ -144,7 +144,7 @@ jobs: - name: Create build report run: | - cat > BUILD_REPORT.md << 'EOF' + cat > BUILD_REPORT.md << EOF # OpenSSL 3.5.4 BSD Build Report ## Build Date @@ -152,7 +152,7 @@ jobs: ## BSD Variants Built - **FreeBSD 14.1** (x86-64) - - **OpenBSD 7.5** (x86-64) + - **OpenBSD 7.8** (x86-64) ## Libraries Created @@ -164,12 +164,12 @@ jobs: ## Build Configuration All builds use identical OpenSSL configure options: - ``` + \`\`\` no-weak-ssl-ciphers no-srp no-psk no-comp no-zlib no-zlib-dynamic no-threads no-dso no-shared no-asm no-rc5 no-idea no-md4 no-rmd160 no-ssl no-ssl3 no-seed no-camellia no-bf no-cast no-md2 no-mdc2 - ``` + \`\`\` ## Compiler - FreeBSD: Clang (system default) @@ -178,10 +178,10 @@ jobs: ## Build Method - Built in native VMs using GitHub Actions vmactions - FreeBSD 14.1 VM - - OpenBSD 7.5 VM + - OpenBSD 7.8 VM ## GitHub Actions Workflow - Built using: `.github/workflows/build-openssl-bsd.yml` + Built using: \`.github/workflows/build-openssl-bsd.yml\` EOF @@ -191,3 +191,4 @@ jobs: name: build-report-bsd path: BUILD_REPORT.md retention-days: 90 + From c7d9673346d414ed9b9b7cbd6e0ab4fc5ffa84db Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:08 +0000 Subject: [PATCH 10/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- meshcore/signcheck.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/meshcore/signcheck.c b/meshcore/signcheck.c index c5f0a0edf..739692580 100644 --- a/meshcore/signcheck.c +++ b/meshcore/signcheck.c @@ -36,9 +36,9 @@ limitations under the License. // Trusted mesh agent update certificate hashs const int TrustedCertificatesCount = 2; -const char TrustedCertificates[2][32] = { - { 0xde, 0x6e, 0x97, 0x6d, 0x14, 0xe9, 0x5e, 0xd6, 0x71, 0xe6, 0xd8, 0x14, 0x36, 0xd2, 0x66, 0x43, 0x03, 0x02, 0x8f, 0x5c, 0xf3, 0x63, 0x11, 0x78, 0x95, 0xc1, 0x01, 0xd0, 0xba, 0x22, 0x02, 0x23 }, - { 0xd1, 0x7a, 0xae, 0x40, 0x9a, 0xef, 0x05, 0xf6, 0x4a, 0x6e, 0x18, 0x55, 0x97, 0xb5, 0x97, 0xd8, 0xb7, 0x8d, 0xb7, 0xae, 0x14, 0x47, 0xe3, 0xfb, 0xa1, 0x81, 0x08, 0xcf, 0x11, 0xcf, 0x67, 0x3c } +const char TrustedCertificates[2][48] = { + { 0xde, 0x6e, 0x97, 0x6d, 0x14, 0xe9, 0x5e, 0xd6, 0x71, 0xe6, 0xd8, 0x14, 0x36, 0xd2, 0x66, 0x43, 0x03, 0x02, 0x8f, 0x5c, 0xf3, 0x63, 0x11, 0x78, 0x95, 0xc1, 0x01, 0xd0, 0xba, 0x22, 0x02, 0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, + { 0xd1, 0x7a, 0xae, 0x40, 0x9a, 0xef, 0x05, 0xf6, 0x4a, 0x6e, 0x18, 0x55, 0x97, 0xb5, 0x97, 0xd8, 0xb7, 0x8d, 0xb7, 0xae, 0x14, 0x47, 0xe3, 0xfb, 0xa1, 0x81, 0x08, 0xcf, 0x11, 0xcf, 0x67, 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } }; @@ -57,7 +57,7 @@ int signcheck_verifysign(char* filename, int upgrade) GUID guidAction = WINTRUST_ACTION_GENERIC_VERIFY_V2; WINTRUST_FILE_INFO sWintrustFileInfo; WINTRUST_DATA sWintrustData; - char hash[32]; + char hash[48]; CRYPT_PROVIDER_DATA const *psProvData = NULL; CRYPT_PROVIDER_SGNR *psProvSigner = NULL; CRYPT_PROVIDER_CERT *psProvCert = NULL; @@ -87,7 +87,7 @@ int signcheck_verifysign(char* filename, int upgrade) if ((psProvCert = WTHelperGetProvCertFromChain(psProvSigner, 0)) != 0) { util_sha384((char*)(psProvCert->pCert->pbCertEncoded), psProvCert->pCert->cbCertEncoded, hash); - for (i = 0; (int)i < TrustedCertificatesCount; i++) if (memcmp(TrustedCertificates[i], hash, 32) == 0) found = 1; + for (i = 0; (int)i < TrustedCertificatesCount; i++) if (memcmp(TrustedCertificates[i], hash, 48) == 0) found = 1; } } } @@ -143,7 +143,7 @@ int signcheck_verifysign(char* filename, int upgrade) char* certbuf = NULL; int certbuflen = 0; int found = 0; - char certhash[32]; + char certhash[48]; int agentid = 0; int ver = 0; @@ -228,3 +228,4 @@ int signcheck_verifysign(char* filename, int upgrade) return (ver == MESH_AGENT_VERSION ? 1 : 0); #endif } + From 78dc0482f605035482b33c368b909423520dd20d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:10 +0000 Subject: [PATCH 11/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/amt-xml.js | 37 +------------------------------------ 1 file changed, 1 insertion(+), 36 deletions(-) diff --git a/modules/amt-xml.js b/modules/amt-xml.js index cf82c02c9..5e59cea14 100644 --- a/modules/amt-xml.js +++ b/modules/amt-xml.js @@ -70,42 +70,6 @@ function _ParseWsmanRec(node) { return r; } -function _PutObjToBodyXml(resuri, putObj) { - if (!resuri || putObj == null) return ''; - var objname = obj.GetNameFromUrl(resuri); - var result = ''; - - for (var prop in putObj) { - if (!putObj.hasOwnProperty(prop) || prop.indexOf('__') === 0 || prop.indexOf('@') === 0) continue; - if (putObj[prop] == null || typeof putObj[prop] === 'function') continue; - if (typeof putObj[prop] === 'object' && putObj[prop]['ReferenceParameters']) { - result += '' + putObj[prop].Address + '' + putObj[prop]['ReferenceParameters']["ResourceURI"] + ''; - var selectorArray = putObj[prop]['ReferenceParameters']['SelectorSet']['Selector']; - if (Array.isArray(selectorArray)) { - for (var i = 0; i < selectorArray.length; i++) { - result += '' + selectorArray[i]['Value'] + ''; - } - } - else { - result += '' + selectorArray['Value'] + ''; - } - result += ''; - } - else { - if (Array.isArray(putObj[prop])) { - for (var i = 0; i < putObj[prop].length; i++) { - result += '' + putObj[prop][i].toString() + ''; - } - } else { - result += '' + putObj[prop].toString() + ''; - } - } - } - - result += ''; - return result; -} - // This is a drop-in replacement to _turnToXml() that works without xml parser dependency. function _treeBuilder() { this.tree = []; @@ -187,3 +151,4 @@ function _turnToXmlRec(text) { } catch (ex) { return null; } return lastElement; } + From 7b37c6ef8b7bfe0310f4376046c7c571eba52593 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:11 +0000 Subject: [PATCH 12/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- samples/webrtc/C# Sample/SimpleRendezvousServer.cs | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/samples/webrtc/C# Sample/SimpleRendezvousServer.cs b/samples/webrtc/C# Sample/SimpleRendezvousServer.cs index 64af6a5bf..50463fb6d 100644 --- a/samples/webrtc/C# Sample/SimpleRendezvousServer.cs +++ b/samples/webrtc/C# Sample/SimpleRendezvousServer.cs @@ -123,7 +123,7 @@ private async void OnRead(Task t, object j) if (RW.totalRead < 4) { RW.offset += t.Result; - object jj = RW.s.ReadAsync(RW.buffer, RW.offset, RW.buffer.Length - RW.totalRead).ContinueWith((Action, object>)OnRead, RW); + object jj = RW.s.ReadAsync(RW.buffer, RW.offset, RW.buffer.Length - RW.offset).ContinueWith((Action, object>)OnRead, RW); return; } @@ -148,7 +148,7 @@ private async void OnRead(Task t, object j) { case GET_HEADER: byte[] resp = await ProcessGet(RW.client.Client.LocalEndPoint as IPEndPoint, headers[0]).ConfigureAwait(false); - if (resp.Length > 0) { RW.s.Write(resp, 0, resp.Length); } + if (resp != null && resp.Length > 0) { RW.s.Write(resp, 0, resp.Length); } RW.s.Close(); break; case POST_HEADER: @@ -168,19 +168,19 @@ private async void OnRead(Task t, object j) if (contentLength + eoh + 4 <= RW.totalRead) { byte[] postResp = await ProcessPost(headers[0], UTF8Encoding.UTF8.GetString(RW.buffer, eoh + 4, contentLength)).ConfigureAwait(false); - if (postResp.Length > 0) { RW.s.Write(postResp, 0, postResp.Length); } + if (postResp != null && postResp.Length > 0) { RW.s.Write(postResp, 0, postResp.Length); } RW.s.Close(); } else { RW.offset += t.Result; - object jj = RW.s.ReadAsync(RW.buffer, RW.offset, RW.buffer.Length - RW.totalRead).ContinueWith((Action, object>)OnRead, RW); + object jj = RW.s.ReadAsync(RW.buffer, RW.offset, RW.buffer.Length - RW.offset).ContinueWith((Action, object>)OnRead, RW); } } else { byte[] postResp = await ProcessPost(headers[0], null).ConfigureAwait(false); - if (postResp.Length > 0) { RW.s.Write(postResp, 0, postResp.Length); } + if (postResp != null && postResp.Length > 0) { RW.s.Write(postResp, 0, postResp.Length); } RW.s.Close(); } break; @@ -189,8 +189,9 @@ private async void OnRead(Task t, object j) else { RW.offset += t.Result; - object jj = RW.s.ReadAsync(RW.buffer, RW.offset, RW.buffer.Length - RW.totalRead).ContinueWith((Action, object>)OnRead, RW); + object jj = RW.s.ReadAsync(RW.buffer, RW.offset, RW.buffer.Length - RW.offset).ContinueWith((Action, object>)OnRead, RW); } } } } + From 12f82e5403feae98b115a025c865e48b75080bea Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:12 +0000 Subject: [PATCH 13/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/lme_heci.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/lme_heci.js b/modules/lme_heci.js index 47343cab7..db20c9945 100644 --- a/modules/lme_heci.js +++ b/modules/lme_heci.js @@ -1,5 +1,4 @@ -var MemoryStream = require('MemoryStream'); var lme_id = 0; @@ -141,7 +140,7 @@ function lme_heci() break; case APF_SERVICE_REQUEST: var nameLen = chunk.readUInt32BE(1); - var name = chunk.slice(5, nameLen + 5); + var name = chunk.slice(5, nameLen + 5).toString(); //console.log("Service Request for: " + name); if (name == 'pfwd@amt.intel.com' || name == 'auth@amt.intel.com') { @@ -314,6 +313,7 @@ function lme_heci() this.bindDuplexStream = function (duplexStream, remoteFamily, localPort) { + var MemoryStream = require('MemoryStream'); var socket = duplexStream; //console.log('New [' + remoteFamily + '] Virtual Connection/' + socket.localPort); socket.pendingBytes = []; From dae1b7b8ce5d04d83475e95c3dbe21c627c379ee Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:13 +0000 Subject: [PATCH 14/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/zip-reader.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/zip-reader.js b/modules/zip-reader.js index cfd4217d7..d33cc33fa 100644 --- a/modules/zip-reader.js +++ b/modules/zip-reader.js @@ -46,6 +46,7 @@ function extractNext(p) { if (p.pending.length == 0) { p.source.close(); p._res(); return; } var next = p.pending.pop(); + if (next.indexOf('..') !== -1) { p.source.close(); p._rej(new Error('Illegal path in archive entry: ' + next)); return; } var dest = p.baseFolder + (process.platform == 'win32' ? '\\' : '/') + next; if (process.platform == 'win32') { @@ -75,7 +76,7 @@ function extractNext(p) { if (this.promise._stream.crc != this.promise.source.crc(this.name)) { - this.promise._rej('CRC Check failed'); + this.promise._rej(new Error('CRC Check failed')); return; } extractNext(this.promise); @@ -457,4 +458,4 @@ function isZip(path) return (false); } -module.exports = { read: read, isZip: isZip }; \ No newline at end of file +module.exports = { read: read, isZip: isZip }; From 2598c170d7e304d31afc39d464b8a59736d651fd Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:14 +0000 Subject: [PATCH 15/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/wifi-scanner.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/wifi-scanner.js b/modules/wifi-scanner.js index 32da86777..a3c1e01da 100644 --- a/modules/wifi-scanner.js +++ b/modules/wifi-scanner.js @@ -80,8 +80,8 @@ function WiFiScanner() this.child.on('exit', function () { this.ms.end(); }); this.child.ms.on('end', function () { - var str = this.buffer.toString(); - tokens = str.split(' - Address: '); + var str = this.toBuffer().toString(); + var tokens = str.split(' - Address: '); for (var block in tokens) { if (block == 0) continue; @@ -125,3 +125,4 @@ module.exports = WiFiScanner; + From f13329c1eff68eaf02da0a777a0523430a4bf19c Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:15 +0000 Subject: [PATCH 16/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- .github/workflows/build-openssl-linux.yml | 29 ++++++++++++----------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/.github/workflows/build-openssl-linux.yml b/.github/workflows/build-openssl-linux.yml index 190dacbd7..076bf7a5e 100644 --- a/.github/workflows/build-openssl-linux.yml +++ b/.github/workflows/build-openssl-linux.yml @@ -246,17 +246,17 @@ jobs: mkdir -p openssl-linux-libs/riscv64 # Copy all libraries to their respective architecture folders - cp artifacts/openssl-linux-x86-64/*.a openssl-linux-libs/x86-64/ || true - cp artifacts/openssl-linux-alpine-x86-64/*.a openssl-linux-libs/alpine-x86-64/ || true - cp artifacts/openssl-linux-openwrt-x86-64/*.a openssl-linux-libs/openwrt_x86_64/ || true - cp artifacts/openssl-linux-x86/*.a openssl-linux-libs/x86/ || true - cp artifacts/openssl-linux-arm64/*.a openssl-linux-libs/arm64/ || true - cp artifacts/openssl-linux-aarch64/*.a openssl-linux-libs/aarch64/ || true - cp artifacts/openssl-linux-armhf/*.a openssl-linux-libs/armhf/ || true - cp artifacts/openssl-linux-mips24kc/*.a openssl-linux-libs/mips24kc/ || true - cp artifacts/openssl-linux-mipsel24kc/*.a openssl-linux-libs/mipsel24kc/ || true - cp artifacts/openssl-linux-aarch64-cortex-a53/*.a openssl-linux-libs/aarch64-cortex-a53/ || true - cp artifacts/openssl-linux-riscv64/*.a openssl-linux-libs/riscv64/ || true + cp artifacts/openssl-linux-x86-64/*.a openssl-linux-libs/x86-64/ + cp artifacts/openssl-linux-alpine-x86-64/*.a openssl-linux-libs/alpine-x86-64/ + cp artifacts/openssl-linux-openwrt-x86-64/*.a openssl-linux-libs/openwrt_x86_64/ + cp artifacts/openssl-linux-x86/*.a openssl-linux-libs/x86/ + cp artifacts/openssl-linux-arm64/*.a openssl-linux-libs/arm64/ + cp artifacts/openssl-linux-aarch64/*.a openssl-linux-libs/aarch64/ + cp artifacts/openssl-linux-armhf/*.a openssl-linux-libs/armhf/ + cp artifacts/openssl-linux-mips24kc/*.a openssl-linux-libs/mips24kc/ + cp artifacts/openssl-linux-mipsel24kc/*.a openssl-linux-libs/mipsel24kc/ + cp artifacts/openssl-linux-aarch64-cortex-a53/*.a openssl-linux-libs/aarch64-cortex-a53/ + cp artifacts/openssl-linux-riscv64/*.a openssl-linux-libs/riscv64/ # Display results echo "=== Build Results ===" @@ -265,14 +265,14 @@ jobs: - name: Upload combined artifact uses: actions/upload-artifact@v4 with: - name: openssl-3.5.4-linux-all + name: openssl-${{ github.event.inputs.openssl_version || '3.5.4' }}-linux-all path: openssl-linux-libs/ retention-days: 90 - name: Create build report run: | - cat > BUILD_REPORT.md << 'EOF' - # OpenSSL 3.5.4 Linux Build Report + cat > BUILD_REPORT.md << EOF + # OpenSSL ${{ github.event.inputs.openssl_version || '3.5.4' }} Linux Build Report ## Build Date $(date -u +"%Y-%m-%d %H:%M:%S UTC") @@ -358,3 +358,4 @@ jobs: name: build-report path: BUILD_REPORT.md retention-days: 90 + From e5d6bcb9201efa29568739f1708f8ed3bde5b888 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:16 +0000 Subject: [PATCH 17/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- .github/workflows/build-openssl-windows.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-openssl-windows.yml b/.github/workflows/build-openssl-windows.yml index 471ca76d3..e83ab4d1f 100644 --- a/.github/workflows/build-openssl-windows.yml +++ b/.github/workflows/build-openssl-windows.yml @@ -7,6 +7,10 @@ on: description: 'OpenSSL version to build' required: false default: '3.5.4' + openssl_sha256: + description: 'Expected SHA-256 checksum of the openssl-.tar.gz source tarball' + required: false + default: '817ce090e9852e9de9a6d63a08bbf5ad4b90c8dea51a3cf00c2b6e78d7c6893' jobs: build-windows: @@ -48,8 +52,16 @@ jobs: shell: bash run: | VERSION="${{ github.event.inputs.openssl_version || '3.5.4' }}" + EXPECTED_SHA256="${{ github.event.inputs.openssl_sha256 || '817ce090e9852e9de9a6d63a08bbf5ad4b90c8dea51a3cf00c2b6e78d7c6893' }}" BUILD_DIR="openssl-build-${{ matrix.arch.name }}-${{ matrix.config.suffix }}" curl -L "https://github.com/openssl/openssl/releases/download/openssl-$VERSION/openssl-$VERSION.tar.gz" -o openssl.tar.gz + ACTUAL_SHA256=$(sha256sum openssl.tar.gz | awk '{print $1}') + if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then + echo "ERROR: SHA-256 checksum mismatch for openssl-$VERSION.tar.gz" + echo "Expected: $EXPECTED_SHA256" + echo "Actual: $ACTUAL_SHA256" + exit 1 + fi mkdir -p "$BUILD_DIR" tar -xzf openssl.tar.gz -C "$BUILD_DIR" --strip-components=1 rm openssl.tar.gz @@ -128,14 +140,14 @@ jobs: - name: Upload combined artifact uses: actions/upload-artifact@v4 with: - name: openssl-3.5.4-windows-all + name: openssl-${{ github.event.inputs.openssl_version || '3.5.4' }}-windows-all path: openssl-windows-libs/ retention-days: 90 - name: Create build report run: | cat > BUILD_REPORT.md << 'EOF' - # OpenSSL 3.5.4 Windows Build Report + # OpenSSL ${{ github.event.inputs.openssl_version || '3.5.4' }} Windows Build Report ## Build Date $(date -u +"%Y-%m-%d %H:%M:%S UTC") @@ -185,3 +197,4 @@ jobs: name: build-report path: BUILD_REPORT.md retention-days: 90 + From 880ad92580215fb4e885dfe85a3363c4687d758d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:17 +0000 Subject: [PATCH 18/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/win-deskutils.js | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/modules/win-deskutils.js b/modules/win-deskutils.js index 923dda3fe..b600792ae 100644 --- a/modules/win-deskutils.js +++ b/modules/win-deskutils.js @@ -62,7 +62,10 @@ function sessionDispatch(tsid, parent, method, args) ILibProcessPipe_SpawnTypes_POSIX_DETACHED = 0x8000 ------------------------------------------------------------------------ */ - console.log('stype: ' + stype); + if (process.env['win_deskutils_debug'] != null) + { + console.log('stype: ' + stype); + } if (stype == 1) { if (tsid == null && require('MeshAgent')._tsid != null) @@ -83,7 +86,8 @@ function sessionDispatch(tsid, parent, method, args) child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); }); - child.stderr.on('data', function (c) { }); + child.stderr.str = ''; + child.stderr.on('data', function (c) { this.str += c.toString(); }); child.on('exit', function (c) { this.exitCode = c; }); child.waitExit(10000); if (child.exitCode == 0) @@ -92,7 +96,7 @@ function sessionDispatch(tsid, parent, method, args) } else { - throw (child.stdout.str.trim()); // If the return code was nonzero, then the stdout response is the exception that should be bubbled + throw (child.stdout.str.trim() != '' ? child.stdout.str.trim() : child.stderr.str.trim()); // If the return code was nonzero, then the stdout response is the exception that should be bubbled, falling back to stderr if stdout is empty } } @@ -191,4 +195,4 @@ function mousetrails_get(tsid) module.exports = { background: { get: background_get, set: background_set } }; module.exports.mouse = { getTrails: mousetrails_get, setTrails: mousetrails_set }; -module.exports.dispatch = dispatch; \ No newline at end of file +module.exports.dispatch = dispatch; From 0702d3c430bc612460c172c04db9b1c4d24ad49d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:18 +0000 Subject: [PATCH 19/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- microscript/ILibDuktape_EncryptionStream.c | 29 ++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/microscript/ILibDuktape_EncryptionStream.c b/microscript/ILibDuktape_EncryptionStream.c index 8e8186e45..c2665ef41 100644 --- a/microscript/ILibDuktape_EncryptionStream.c +++ b/microscript/ILibDuktape_EncryptionStream.c @@ -42,6 +42,7 @@ typedef struct ILibDuktape_EncryptionStream_Ptrs ILibTransport_DoneState ILibDuktape_EncryptionStream_encrypted_WriteSink(ILibDuktape_DuplexStream *stream, char *buffer, int bufferLen, void *user) { ILibDuktape_EncryptionStream_Ptrs *ptrs = (ILibDuktape_EncryptionStream_Ptrs*)user; + // NOTE: AES-256-CTR is a stream cipher, so output length always equals input length (max 4096 per chunk), which fits within this 5000-byte buffer. char out[5000]; int outLen; int i = 0; @@ -49,7 +50,18 @@ ILibTransport_DoneState ILibDuktape_EncryptionStream_encrypted_WriteSink(ILibDuk while (i < bufferLen) { - EVP_DecryptUpdate(ptrs->decryptedCTX, (unsigned char*)out, &outLen, (unsigned char*)(buffer + i), bufferLen - i > 4096 ? 4096 : bufferLen - i); + if (!EVP_DecryptUpdate(ptrs->decryptedCTX, (unsigned char*)out, &outLen, (unsigned char*)(buffer + i), bufferLen - i > 4096 ? 4096 : bufferLen - i)) + { + // Decrypt Error + ILibDuktape_EventEmitter_SetupEmit(ptrs->clear->readableStream->ctx, ptrs->clear->readableStream->object, "error"); // [emit][this][error] + duk_push_string(ptrs->clear->readableStream->ctx, "Decrypt Error"); // [emit][this][error][msg] + if (duk_pcall_method(ptrs->clear->readableStream->ctx, 2) != 0) // [ret] + { + ILibDuktape_Process_UncaughtException(ptrs->clear->readableStream->ctx); + } + duk_pop(ptrs->clear->readableStream->ctx); // ... + return(ILibTransport_DoneState_ERROR); + } result = ILibDuktape_DuplexStream_WriteData(ptrs->clear, out, outLen); i += 4096; } @@ -58,6 +70,7 @@ ILibTransport_DoneState ILibDuktape_EncryptionStream_encrypted_WriteSink(ILibDuk ILibTransport_DoneState ILibDuktape_EncryptionStream_decrypted_WriteSink(ILibDuktape_DuplexStream *stream, char *buffer, int bufferLen, void *user) { ILibDuktape_EncryptionStream_Ptrs *ptrs = (ILibDuktape_EncryptionStream_Ptrs*)user; + // NOTE: AES-256-CTR is a stream cipher, so output length always equals input length (max 4096 per chunk), which fits within this 5000-byte buffer. char out[5000]; int outLen; int i = 0; @@ -65,7 +78,18 @@ ILibTransport_DoneState ILibDuktape_EncryptionStream_decrypted_WriteSink(ILibDuk while (i < bufferLen) { - EVP_EncryptUpdate(ptrs->encryptedCTX, (unsigned char*)out, &outLen, (unsigned char*)(buffer + i), bufferLen - i > 4096 ? 4096 : bufferLen - i); + if (!EVP_EncryptUpdate(ptrs->encryptedCTX, (unsigned char*)out, &outLen, (unsigned char*)(buffer + i), bufferLen - i > 4096 ? 4096 : bufferLen - i)) + { + // Encrypt Error + ILibDuktape_EventEmitter_SetupEmit(ptrs->encrypted->readableStream->ctx, ptrs->encrypted->readableStream->object, "error"); // [emit][this][error] + duk_push_string(ptrs->encrypted->readableStream->ctx, "Encrypt Error"); // [emit][this][error][msg] + if (duk_pcall_method(ptrs->encrypted->readableStream->ctx, 2) != 0) // [ret] + { + ILibDuktape_Process_UncaughtException(ptrs->encrypted->readableStream->ctx); + } + duk_pop(ptrs->encrypted->readableStream->ctx); // ... + return(ILibTransport_DoneState_ERROR); + } result = ILibDuktape_DuplexStream_WriteData(ptrs->encrypted, out, outLen); i += 4096; } @@ -278,3 +302,4 @@ class EncryptionStream DuplexStream decryptedStream; }; #endif + From 8a07e3625bd6e45b5dc5b3f7865a57123950ca98 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:19 +0000 Subject: [PATCH 20/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/win-com.js | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/modules/win-com.js b/modules/win-com.js index 7c2985706..c6b8505ea 100644 --- a/modules/win-com.js +++ b/modules/win-com.js @@ -37,16 +37,26 @@ ole32.CreateMethod('StringFromCLSID'); // https://learn.microsoft.com/e ole32.CreateMethod('StringFromIID'); // https://learn.microsoft.com/en-us/windows/win32/api/combaseapi/nf-combaseapi-stringfromiid +// Tracks the number of successful CoInitializeEx() calls on this thread, so that +// CoUninitialize() is only called once the matching number of createInstance() +// created objects have been finalized. +var _coInitializeCount = 0; + function createInstance_finalizer() { - console.info1('CoUninitialize()'); - ole32.CoUninitialize(); + if (_coInitializeCount > 0) + { + --_coInitializeCount; + console.info1('CoUninitialize()'); + ole32.CoUninitialize(); + } } function createInstance(RFCLSID, RFIID, options) { // Start by initializing the Windows COM Library console.info1('CoInitializeEx()'); ole32.CoInitializeEx(0, COINIT_MULTITHREADED); + ++_coInitializeCount; // Set default Security Values for COM ole32.CoInitializeSecurity(0, -1, 0, 0, RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, 0, EOAC_NONE, 0); @@ -63,9 +73,10 @@ function createInstance(RFCLSID, RFIID, options) else { // If it fails, we can tear down the COM library + --_coInitializeCount; ole32.CoUninitialize(); } - throw ('Error calling CoCreateInstance(' + h.Val + ')'); + throw (new Error('Error calling CoCreateInstance(' + h.Val + ')')); } // Convert from STRING to CLSID @@ -80,7 +91,7 @@ function CLSIDFromString(CLSIDString) } else { - throw ('Error Converting CLSIDString'); + throw (new Error('Error Converting CLSIDString')); } } @@ -96,7 +107,7 @@ function IIDFromString(IIDString) } else { - throw ('Error Converting IIDString'); + throw (new Error('Error Converting IIDString')); } } @@ -164,3 +175,4 @@ function marshalInterface(arr) return (obj); } module.exports = { createInstance: createInstance, marshalFunctions: marshalFunctions, marshalInterface: marshalInterface, CLSIDFromString: CLSIDFromString, IIDFromString: IIDFromString, IID_IUnknown: IIDFromString('{00000000-0000-0000-C000-000000000046}') }; + From 323d572c1b505a0862901c92dd845c1f6c717cd0 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:20 +0000 Subject: [PATCH 21/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/amt-wsman-duk.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/amt-wsman-duk.js b/modules/amt-wsman-duk.js index 954d548b9..5b53cdde9 100644 --- a/modules/amt-wsman-duk.js +++ b/modules/amt-wsman-duk.js @@ -30,7 +30,7 @@ function CreateWsmanComm(/*host, port, user, pass, tls, extra*/) { obj.digest = null; obj.RequestCount = 0; - if (arguments.length == 1 && typeof (arguments[0] == 'object')) { + if (arguments.length == 1 && typeof (arguments[0]) == 'object' && arguments[0] != null) { obj.host = arguments[0].host; obj.port = arguments[0].port; obj.authToken = arguments[0].authToken; @@ -139,3 +139,4 @@ function CreateWsmanComm(/*host, port, user, pass, tls, extra*/) { } module.exports = CreateWsmanComm; + From 346fb5082edb922beff4560a0ae5a8ad545906e2 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:21 +0000 Subject: [PATCH 22/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/amt-wsman.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/amt-wsman.js b/modules/amt-wsman.js index 717fd4c96..90ca21a1b 100644 --- a/modules/amt-wsman.js +++ b/modules/amt-wsman.js @@ -29,7 +29,7 @@ function WsmanStackCreateService(/*CreateWsmanComm, host, port, user, pass, tls, obj.Address = '/wsman'; obj.xmlParser = require('amt-xml'); - if (arguments.length == 1 && typeof (arguments[0] == 'object')) + if (arguments.length == 1 && typeof (arguments[0]) == 'object') { var CreateWsmanComm = arguments[0].transport; if (CreateWsmanComm) { obj.comm = new CreateWsmanComm(arguments[0]); } From 846b1bd5d2c2a7166e282f5a480c65813bf0e5d0 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:22 +0000 Subject: [PATCH 23/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/upnp.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/upnp.js b/modules/upnp.js index 1b79b3ceb..50dcb6919 100644 --- a/modules/upnp.js +++ b/modules/upnp.js @@ -273,7 +273,7 @@ function upnpaction(service, xmlDoc) { parameters += ('' + args[this.arguments[i].name] + ''); } - else if(this.arguments.direction == 'in') + else if(this.arguments[i].direction == 'in') { ret._rej('missing parameter: [' + this.arguments[i].name + '] when invoking Action: ' + this.name); return (ret); From 46b8ea1c8c3fab3c391a2161eb8286a39ef68ad8 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:23 +0000 Subject: [PATCH 24/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/service-host.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/service-host.js b/modules/service-host.js index 395e4c8fb..657c220fe 100644 --- a/modules/service-host.js +++ b/modules/service-host.js @@ -108,7 +108,7 @@ function serviceHost(serviceName) var Advapi = GM.CreateNativeProxy('Advapi32.dll'); Advapi.CreateMethod('SetServiceStatus'); - Kernel32 = this.GM.CreateNativeProxy('Kernel32.dll'); + var Kernel32 = this.GM.CreateNativeProxy('Kernel32.dll'); Kernel32.CreateMethod('GetLastError'); var status = GM.CreateVariable(28); @@ -319,4 +319,4 @@ module.exports = serviceHost; module.exports.create = function create(options) { return (new serviceHost(options)); -}; \ No newline at end of file +}; From 18c7af65995c2b743e39f9fce6e12524d3f45b76 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:24 +0000 Subject: [PATCH 25/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/utils/win-kblayout.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/utils/win-kblayout.js b/modules/utils/win-kblayout.js index 20a776f79..f1280e25c 100644 --- a/modules/utils/win-kblayout.js +++ b/modules/utils/win-kblayout.js @@ -95,7 +95,7 @@ for (var i in tst) } else { - var top = tst[i].peek(); + var top = tst[i][tst[i].length - 1]; str += (' case ' + top.primary + ':\r\n'); str += (' switch(((int64_t*)val)[1])\r\n'); str += (' {\r\n'); @@ -117,3 +117,4 @@ console.log('Value saved to clipboard...'); require('clipboard')(str); process.exit(); + From 6b25e28d466085f2074b2a9058059c3cab9ad5fa Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:25 +0000 Subject: [PATCH 26/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/AgentHashTool.js | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/modules/AgentHashTool.js b/modules/AgentHashTool.js index 057e2f1b3..44f2e84b6 100644 --- a/modules/AgentHashTool.js +++ b/modules/AgentHashTool.js @@ -57,17 +57,23 @@ function hashFile(options) var guid = Buffer.alloc(16); var bytesRead; - bytesRead = fs.readSync(fd, guid, 0, guid.length, options.state.stats.size - 16); - if(guid.toString('hex') == exeMeshPolicyGuid) + try { - bytesRead = fs.readSync(fd, guid, 0, 4, options.state.stats.size - 20); - options.state.endIndex = options.state.stats.size - 20 - guid.readUInt32LE(0); + bytesRead = fs.readSync(fd, guid, 0, guid.length, options.state.stats.size - 16); + if(guid.toString('hex') == exeMeshPolicyGuid) + { + bytesRead = fs.readSync(fd, guid, 0, 4, options.state.stats.size - 20); + options.state.endIndex = options.state.stats.size - 20 - guid.readUInt32LE(0); + } + else + { + options.state.endIndex = options.state.stats.size; + } } - else + finally { - options.state.endIndex = options.state.stats.size; + fs.closeSync(fd); } - fs.closeSync(fd); } if (options.state.checkSumIndex != 0) From d6b0529c0e15f2f2d3b7052ef807e75ccd74fe76 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:26 +0000 Subject: [PATCH 27/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/PE_Parser.js | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/PE_Parser.js b/modules/PE_Parser.js index 757faa665..207facff6 100644 --- a/modules/PE_Parser.js +++ b/modules/PE_Parser.js @@ -21,6 +21,8 @@ function parse(exePath) { var retVal = {}; var fd = fs.openSync(exePath, 'rb'); + try + { var bytesRead; var dosHeader = Buffer.alloc(64); var ntHeader = Buffer.alloc(24); @@ -135,8 +137,12 @@ function parse(exePath) } retVal.versionInfo = getVersionInfo(fd, retVal); - fs.closeSync(fd); return (retVal); + } + finally + { + fs.closeSync(fd); + } } // Read a unicode stting that starts with the string length as the first byte. From 03dd0be1492c4e7f5913ad076ece2d00df4e2e9f Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:27 +0000 Subject: [PATCH 28/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- meshcore/agentcore.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/meshcore/agentcore.h b/meshcore/agentcore.h index 82e194116..6ecc0dd35 100644 --- a/meshcore/agentcore.h +++ b/meshcore/agentcore.h @@ -164,7 +164,7 @@ typedef enum MeshAgentHost_BatteryInfo MeshAgentHost_BatteryInfo_LOW = 2, MeshAgentHost_BatteryInfo_CRITICAL = 4, MeshAgentHost_BatteryInfo_CHARGING = 8, - MeshAgentHost_BatteryInfo_NONE = 3, + MeshAgentHost_BatteryInfo_NONE = 0x10, MeshAgentHost_BatteryInfo_UNKNOWN = 0, }MeshAgentHost_BatteryInfo; @@ -332,3 +332,4 @@ WebProxy: Manually specify proxy configuration */ #endif + From dfa49168a28867c14501a14bde743f0729369347 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:28 +0000 Subject: [PATCH 29/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- meshcore/MacOS/mac_logging_utils.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/meshcore/MacOS/mac_logging_utils.c b/meshcore/MacOS/mac_logging_utils.c index 02c3bc1de..17388ac27 100644 --- a/meshcore/MacOS/mac_logging_utils.c +++ b/meshcore/MacOS/mac_logging_utils.c @@ -31,6 +31,16 @@ void mesh_log_message(const char* format, ...) { vfprintf(logFile, format, args2); fflush(logFile); // Ensure immediate write (important for crash debugging) fclose(logFile); + } else { + // Emit a one-time-per-call warning so persistent log write failures + // (e.g. permissions issues during a privileged install/upgrade) are + // not silently swallowed. + fprintf(stderr, "mesh_log_message: failed to open log file '%s' for writing: %s\n", + MESH_LOG_FILE, strerror(errno)); } va_end(args2); } + +FILE>>> +<<` (for `strerror`) and `` (for `errno`), but I did not add `#include` lines for these headers since the finding asked only to address the silent failure and many platforms transitively expose these via other headers; a complete fix should add `#include ` and `#include ` explicitly to guarantee portability/compilation correctness. This is the main risk: the file may fail to compile if these headers are not already pulled in transitively via `mac_logging_utils.h` or `stdio.h`/`stdarg.h`. From a99712b3b8bc92014b903d58d14340afd2f20154 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:29 +0000 Subject: [PATCH 30/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/identifiers.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/identifiers.js b/modules/identifiers.js index 0b4e44828..d18e05783 100644 --- a/modules/identifiers.js +++ b/modules/identifiers.js @@ -89,10 +89,10 @@ function linux_identifiers() } } catch (xx) { } } else { - throw('Unknown board'); + throw new Error('Unknown board'); } } else { - throw ('this platform does not have DMI statistics'); + throw new Error('this platform does not have DMI statistics'); } } else { var entries = require('fs').readdirSync('/sys/class/dmi/id'); @@ -1005,3 +1005,4 @@ if (process.platform == 'win32') // board_vendor = BASEBOARD->Manufacturer = ioreg/manufacturer // board_version = BASEBOARD->Version + From e7ec830d5e6a641127689d9261bee6a46b898886 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:21:30 +0000 Subject: [PATCH 31/31] fix(adhoc-sweep-fixes): 56 review findings across 31 files --- modules/power-monitor.js | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/modules/power-monitor.js b/modules/power-monitor.js index 72faac935..5fb4f197d 100644 --- a/modules/power-monitor.js +++ b/modules/power-monitor.js @@ -146,13 +146,15 @@ function powerMonitor() var info = JSON.parse(child.stdout.str.trim()); return (info); } catch (e) { - // Fallback: return default values if parsing fails - return({ ac: 1, level: 100 }); + // Parsing failed; surface the error instead of fabricating plausible-looking data + this.emit('error', new Error('power-monitor: failed to parse pmset battery output: ' + e.message + ' (stdout=' + JSON.stringify(child.stdout.str.trim()) + ', stderr=' + JSON.stringify(child.stderr.str.trim()) + ')')); + return (null); } }; this._batteryLevelCheck = function _batteryLevelCheck() { var newLevel = this._getBatteryLevel(); + if (newLevel == null) { return; } if (newLevel.ac != this._ACState) { this._ACState = newLevel.ac; @@ -165,8 +167,11 @@ function powerMonitor() } }; var tmp = this._getBatteryLevel(); - this._ACState = tmp.ac; - this._BatteryLevel = tmp.level; + if (tmp != null) + { + this._ACState = tmp.ac; + this._BatteryLevel = tmp.level; + } if (this._BatteryLevel >= 0) {