- shovel(): fd2fd() returns FD_NODATA (-1) when a spurious wakeup
meets an empty socket (EAGAIN), but the switch treated -1 like
FD_CNXCLOSED and tore down a healthy connection. Only FD_CNXCLOSED
closes now.
- decrease_forked_connection(): hash_find() can return NULL (stale
SIGCHLD after a fork-limit rejection); dereferencing it crashed.
Guard and log instead.
- hexdump(): sprintf() into a 76-byte stack buffer with a "%06x"
offset that needs 12 chars once the dump passes 16 MB. Enlarge the
buffer and bound all writes with snprintf().
- printsettings(): sprintf() of config-supplied host strings into a
fixed buffer; use snprintf().
- echosrv: recvfrom() into data+prefix_len with size
sizeof(data)-prefix_len lets the terminating NUL write land one
byte past the stack buffer (verified with ASan at udp_echo, and a
>64KB prefix overflows the memcpy). Bound the prefix, reserve one
byte for the terminator, and skip the echo on recvfrom() error
instead of writing data[prefix_len-1].
- msg_int_error used verbose_system_error, leaving the documented
--verbose-int-error option dead. Point it at its own setting.
- Remove "echoѕrv-conf.h" (with Cyrillic ѕ, U+0455): a stale 2020
sslh-conf.h copy committed under a filename that is visually
identical to echosrv-conf.h but referenced by nothing.
Stefan Meinecke
Yves Rutschle
Toni Uhlig