fix(adhoc-sweep-fixes): CU-86akdypw4 19 review findings across 19 files

.github/workflows/test-makefile-build-macos-universal.yml

@@ -4,9 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       branch:
-        description: 'Branch to build from (default: OpenSSL_Pipeline_3.5.4_Upgrade_v2)'
+        description: 'Branch to build from (default: main)'
         required: false
-        default: 'OpenSSL_Pipeline_3.5.4_Upgrade_v2'
+        default: 'main'
 
 jobs:
   test-build-universal:
@@ -17,7 +17,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.branch || 'OpenSSL_Pipeline_3.5.4_Upgrade_v2' }}
+          ref: ${{ github.event.inputs.branch || 'main' }}
 
       - name: Verify macOS version and architecture
         run: |
@@ -157,3 +157,4 @@ jobs:
             build/meshagent_macos-x86-64
             build/meshagent_macos-arm-64
           retention-days: 7
+

.github/workflows/test.yml

@@ -1,11 +1,4 @@
 name: MeshAgent Test
-permissions:
-  contents: write
-  packages: write
-  actions: write
-  pull-requests: write
-  attestations: write
-  id-token: write
 
 on:
   pull_request:
@@ -31,6 +24,8 @@ jobs:
   build_client:
     name: "Build C Client (${{ matrix.os }})"
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     if: |
       (github.event_name == 'pull_request' && !github.event.pull_request.draft)
     defaults:
@@ -86,4 +81,4 @@ jobs:
         run: |
           echo "Building MeshAgent for macOS ${{ matrix.os_arch }}"
           make macos ARCHID=${{ matrix.archid }}
-        shell: bash
+        shell: bash

meshcore/KVM/Windows/input.c

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-#if defined(_LINKVM)
+#if defined(_LINKVM) && defined(WIN32)
 
 #include <Windows.h>
 #include <Winuser.h>
@@ -611,3 +611,4 @@ int TouchAction2(char* data, int datalen, int scaling)
 }
 
 #endif
+

meshcore/KVM/Windows/tile.cpp

@@ -89,7 +89,7 @@ int GetEncoderClsid(const WCHAR* format, CLSID* pClsid)
 
 	for (unsigned int j = 0; j < num; ++j)
 	{
-		if (wcsncmp(pImageCodecInfo[j].MimeType, format, size) == 0)
+		if (wcsncmp(pImageCodecInfo[j].MimeType, format, wcslen(format)) == 0)
 		{
 			*pClsid = pImageCodecInfo[j].Clsid;
 			free(pImageCodecInfo);
@@ -648,3 +648,4 @@ void set_tile_compression(int type, int level)
 }
 
 #endif
+

meshcore/wincrypto-dualmode.cpp

@@ -391,10 +391,15 @@ int __fastcall wincrypto_open(int newcert)
 	if (hKeyNode != NULL) CryptDestroyKey(hKeyNode);
 #endif
 	wincrypto_close();
+	if (subjectEncoded != NULL) free(subjectEncoded);
+	if (pbPolicyInfo2 != NULL) free(pbPolicyInfo2);
+	if (pbBasicConstraints != NULL) free(pbBasicConstraints);
 	return 1;
 
 end:
 	if (subjectEncoded != NULL) free(subjectEncoded);
+	if (pbPolicyInfo2 != NULL) free(pbPolicyInfo2);
+	if (pbBasicConstraints != NULL) free(pbBasicConstraints);
 	return 0;
 }
 

microscript/ILibDuktape_CompressedStream.c

@@ -122,6 +122,7 @@ void ILibDuktape_Compressor_End(ILibDuktape_DuplexStream *stream, void *user)
 	char tmp[16384];
 	size_t avail;
 	int res;
+	int errFlag = 0;
 	cs->Z.avail_in = 0;
 	cs->Z.next_in = (Bytef*)ILibScratchPad;
 
@@ -131,6 +132,7 @@ void ILibDuktape_Compressor_End(ILibDuktape_DuplexStream *stream, void *user)
 		cs->Z.next_out = (Bytef*)tmp;
 		if ((res = deflate(&(cs->Z), Z_FINISH)) != Z_OK && res != Z_STREAM_END)
 		{
+			errFlag = 1;
 			break;
 		}
 		avail = sizeof(tmp) - cs->Z.avail_out;
@@ -140,6 +142,15 @@ void ILibDuktape_Compressor_End(ILibDuktape_DuplexStream *stream, void *user)
 			ILibDuktape_DuplexStream_WriteData(cs->ds, tmp, (int)avail);
 		}
 	} while (cs->Z.avail_out == 0);
+	if (errFlag != 0)
+	{
+		duk_push_heapptr(ctx, cs->object);							// [stream]
+		duk_push_error_object(ctx, DUK_ERR_ERROR, "Compressor error: deflate() failed");	// [stream][error]
+		ILibDuktape_EventEmitter_SetupEmit(ctx, -2, "error");		// [stream][error][emit]
+		duk_swap(ctx, -1, -2);										// [stream][emit][error]
+		duk_pcall_method(ctx, 1);									// [stream][result]
+		duk_pop_2(ctx);												// ...
+	}
 	ILibDuktape_DuplexStream_WriteEnd(cs->ds);
 
 	ignore_result(deflateEnd(&(cs->Z)));
@@ -290,13 +301,15 @@ void ILibDuktape_deCompressor_End(ILibDuktape_DuplexStream *stream, void *user)
 	cs->Z.avail_in = 0;
 	cs->Z.next_in = (Bytef*)ILibScratchPad;
 	int res;
+	int errFlag = 0;
 
 	do
 	{
 		cs->Z.avail_out = sizeof(tmp);
 		cs->Z.next_out = (Bytef*)tmp;
 		if ((res = inflate(&(cs->Z), Z_FINISH)) != Z_OK && res != Z_STREAM_END)
 		{
+			errFlag = 1;
 			break;
 		}
 		avail = sizeof(tmp) - cs->Z.avail_out;
@@ -306,6 +319,15 @@ void ILibDuktape_deCompressor_End(ILibDuktape_DuplexStream *stream, void *user)
 			ILibDuktape_DuplexStream_WriteData(cs->ds, tmp, (int)avail); 
 		}
 	} while (cs->Z.avail_out == 0);
+	if (errFlag != 0)
+	{
+		duk_push_heapptr(ctx, cs->object);							// [stream]
+		duk_push_error_object(ctx, DUK_ERR_ERROR, "Decompressor error: inflate() failed");	// [stream][error]
+		ILibDuktape_EventEmitter_SetupEmit(ctx, -2, "error");		// [stream][error][emit]
+		duk_swap(ctx, -1, -2);										// [stream][emit][error]
+		duk_pcall_method(ctx, 1);									// [stream][result]
+		duk_pop_2(ctx);												// ...
+	}
 	ILibDuktape_DuplexStream_WriteEnd(cs->ds);
 	ignore_result(inflateEnd(&(cs->Z)));
 
@@ -537,4 +559,4 @@ int ILibInflate(char *buffer, size_t bufferLen, char *decompressed, size_t *deco
 
 	if (crc != 0 && crc != rescrc) { ret = 2; }
 	return(ret);
-}
+}

microscript/ILibDuktape_Dgram.c

@@ -329,7 +329,7 @@ duk_ret_t ILibDuktape_DGram_send(duk_context *ctx)
 		port = (unsigned short)duk_require_int(ctx, 3);
 		for (i = 4; i < nargs; ++i)
 		{
-			if (duk_is_string(ctx, i)) { ILibResolveEx((char*)duk_require_string(ctx, i), port, &local); }
+			if (duk_is_string(ctx, i)) { if (ILibResolveEx((char*)duk_require_string(ctx, i), port, &local) != 0) { local.sin6_family = AF_UNSPEC; } }
 			if (duk_is_function(ctx, i)) { onSendOk = duk_require_heapptr(ctx, i); }
 		}
 	}
@@ -338,7 +338,7 @@ duk_ret_t ILibDuktape_DGram_send(duk_context *ctx)
 		port = (unsigned short)duk_require_int(ctx, 1);
 		for (i = 2; i < nargs; ++i)
 		{
-			if (duk_is_string(ctx, i)) { ILibResolveEx((char*)duk_require_string(ctx, i), port, &local); }
+			if (duk_is_string(ctx, i)) { if (ILibResolveEx((char*)duk_require_string(ctx, i), port, &local) != 0) { local.sin6_family = AF_UNSPEC; } }
 			if (duk_is_function(ctx, i)) { onSendOk = duk_require_heapptr(ctx, i); }
 		}
 	}
@@ -650,3 +650,4 @@ class dgram
 
 
 #endif
+

microstack/ILibAsyncServerSocket.c

@@ -385,7 +385,17 @@ void ILibAsyncServerSocket_OnConnectSink(ILibAsyncSocket_SocketModule socketModu
 {
 	struct ILibAsyncServerSocket_Data *data = (struct ILibAsyncServerSocket_Data*)user;
 	if (data == NULL) return;
-	if (Connected == 0) { free(data); data = NULL; return; } // Connection Failed, clean up
+	if (Connected == 0)
+	{
+		// Connection Failed, clean up
+		if (ILibAsyncSocket_GetUser(socketModule) != NULL)
+		{
+			ILibAsyncSocket_SetUser(socketModule, NULL);
+		}
+		free(data);
+		data = NULL;
+		return;
+	}
 	if (data->module->OnConnect != NULL) data->module->OnConnect(data->module, socketModule, &(data->user));
 }
 // 
@@ -791,3 +801,4 @@ void ILibAsyncServerSocket_SSL_SetSink(ILibAsyncServerSocket_ServerModule AsyncS
 	((struct ILibAsyncServerSocketModule*)AsyncServerSocketModule)->OnSSLContext = handler;
 }
 #endif
+

microstack/nossl/sha224-256.c

@@ -90,10 +90,9 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 /*
 * add "length" to the length
 */
-static uint32_t addTemp;
 #define SHA224_256AddLength(context, length)               \
-  (addTemp = (context)->Length_Low, (context)->Corrupted = \
-    (((context)->Length_Low += (length)) < addTemp) &&     \
+  ((context)->Corrupted = \
+    (((context)->Length_Low += (length)) < (length)) &&     \
     (++(context)->Length_High == 0) ? 1 : 0)
 
 /* Local Function Prototypes */
@@ -634,3 +633,4 @@ SHA224_256ResultN(SHA256Context * context,
 
 	return shaSuccess;
 }
+

modules/_agentNodeId.js

@@ -138,6 +138,7 @@ function _meshName()
 
 function _resetNodeId()
 {
+    if (process.platform != 'win32') { return; }
     var name = _meshName();
     require('win-registry').WriteKey(require('win-registry').HKEY.LocalMachine, 'Software\\Open Source\\' + name, 'ResetNodeId', 1);
     console.log('Resetting NodeID for: ' + name);

modules/amt-lme.js

@@ -150,7 +150,9 @@ function lme_heci(options) {
                     console.log('Unhandled LME Command ' + cmd + ', ' + chunk.length + ' byte(s).');
                     break;
                 case APF_SERVICE_REQUEST:
+                    if (chunk.length < 5) { break; }
                     var nameLen = chunk.readUInt32BE(1);
+                    if (nameLen < 0 || (nameLen + 5) > chunk.length) { break; }
                     var name = chunk.slice(5, nameLen + 5);
                     //console.log("Service Request for: " + name);
                     if (name == 'pfwd@amt.intel.com' || name == 'auth@amt.intel.com') {
@@ -165,12 +167,16 @@ function lme_heci(options) {
                     }
                     break;
                 case APF_GLOBAL_REQUEST:
+                    if (chunk.length < 5) { break; }
                     var nameLen = chunk.readUInt32BE(1);
+                    if (nameLen < 0 || (nameLen + 5) > chunk.length) { break; }
                     var name = chunk.slice(5, nameLen + 5).toString();
 
                     switch (name) {
                         case 'tcpip-forward':
+                            if (chunk.length < (nameLen + 10)) { break; }
                             var len = chunk.readUInt32BE(nameLen + 6);
+                            if (len < 0 || chunk.length < (nameLen + 14 + len)) { break; }
                             var port = chunk.readUInt32BE(nameLen + 10 + len);
                             //console.log("[" + chunk.length + "/" + len + "] APF_GLOBAL_REQUEST for: " + name + " on port " + port);
                             if (this[name] == undefined) { this[name] = {}; }
@@ -379,14 +385,18 @@ function lme_heci(options) {
                     }
                     break;
                 case APF_CHANNEL_OPEN:
+                    if (chunk.length < 5) { break; }
                     var nameLen = chunk.readUInt32BE(1);
+                    if (nameLen < 0 || chunk.length < (nameLen + 21)) { break; }
                     var name = chunk.slice(5, nameLen + 5).toString();
                     var channelSender = chunk.readUInt32BE(nameLen + 5);
                     var initialWindowSize = chunk.readUInt32BE(nameLen + 9);
                     var hostToConnectLen = chunk.readUInt32BE(nameLen + 17);
+                    if (hostToConnectLen < 0 || chunk.length < (nameLen + 29 + hostToConnectLen)) { break; }
                     var hostToConnect = chunk.slice(nameLen + 21, nameLen + 21 + hostToConnectLen).toString();
                     var portToConnect = chunk.readUInt32BE(nameLen + 21 + hostToConnectLen);
                     var originatorIpLen = chunk.readUInt32BE(nameLen + 25 + hostToConnectLen);
+                    if (originatorIpLen < 0 || chunk.length < (nameLen + 33 + hostToConnectLen + originatorIpLen)) { break; }
                     var originatorIp = chunk.slice(nameLen + 29 + hostToConnectLen, nameLen + 29 + hostToConnectLen + originatorIpLen).toString();
                     var originatorPort = chunk.readUInt32BE(nameLen + 29 + hostToConnectLen + originatorIpLen);
                     //console.log('APF_CHANNEL_OPEN', name, channelSender, initialWindowSize, 'From: ' + originatorIp + ':' + originatorPort, 'To: ' + hostToConnect + ':' + portToConnect);