Parents and children of check-in [8ebc3e4dd8]
|
2026-09-24
| ||
| 16:44 |
transport: refuse Basic over plain http to another host; drop it on a cross-host redirect
A Basic challenge was answered whatever the scheme, so over http the password crossed readable and the saved remote repeated it. It is now refused to non-loopback hosts, naming the https URL; a redirect to another host drops the credential; plain http to another host notes it on stderr. Release 0.3.30. check-in: b637cbd37c user: dmestas tags: trunk, version-0.3.30 | |
| 01:02 |
soak: record a finding and keep sweeping; CI: cap the runners' zig cache
A failing fuzz target is abandoned and the sweep moves on, so one recurring crash no longer hides the targets after it; the exit lists every finding. Each workflow clears its zig-local cache whole at job start once it passes 8 GB, since Zig never prunes it. check-in: 8ebc3e4dd8 user: dmestas tags: trunk | |
|
2026-09-23
| ||
| 18:33 |
inflate: a truncated dynamic-block header is the end of the stream, not a crash
tossBitsShort added the consumed bits where it must subtract them, so a header ending one byte short tossed past the end of the input and the next peek read a wrapped length off the stack. Found by the nightly soak four nights running. Release 0.3.29. check-in: 362f18d357 user: dmestas tags: trunk, version-0.3.29 | |