punktfunk

Files

T

enricobuehler 6ada74066d fix(pyrowave): reject a sub-header packet so the decode cursor always advances

security-review 2026-08-15 finding 9. push_packet advanced by
payload_words*4; a 12-bit payload_words of 0 passed the length guard, and
decode_packet's duplicate-block early return fired before its own minimum-size
check — so a duplicate block_index with payload_words==0 spun the client decode
thread at 100% CPU forever (no allocation, no timeout, inside FFI). Hoist the
minimum-size check into push_packet before decode_packet is consulted. Carried
as vendored patch 0008.

2026-08-15 10:48:10 +02:00

patches

fix(pyrowave): reject a sub-header packet so the decode cursor always advances

2026-08-15 10:48:10 +02:00

src

chore(safety): exempt the two bindings-only sys crates from the hoisted deny

2026-08-11 23:41:39 +02:00

vendor/pyrowave

fix(pyrowave): reject a sub-header packet so the decode cursor always advances

2026-08-15 10:48:10 +02:00

build.rs

fix(pyrowave-sys): link user32 on Windows (Granite breadcrumbs MessageBoxA)