[Hamlib-developer] [Hamlib/Hamlib] 30b694: fix(ctl): bound command parser inputs

[Nate B. <no...@gi...>]

  Branch: refs/heads/Hamlib-4.7
  Home:   https://github.com/Hamlib/Hamlib
  Commit: 30b694d6a887667f4ca449e504403f893682a4f5
      https://github.com/Hamlib/Hamlib/commit/30b694d6a887667f4ca449e504403f893682a4f5
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M tests/ampctl_parse.c
    M tests/rigctl_parse.c
    M tests/rotctl_parse.c

  Log Message:
  -----------
  fix(ctl): bound command parser inputs

Reject stream read errors instead of synthesizing empty commands, validate raw hexadecimal command syntax without reading past its terminator, and keep fixed-size command and description inputs within their actual capacities.

(cherry picked from commit c0adbb27bbd5178832dc135633a0e66cb83c4521)


  Commit: e112c04fb7cd0245fa4214c3d7fc48bc03a3ed1f
      https://github.com/Hamlib/Hamlib/commit/e112c04fb7cd0245fa4214c3d7fc48bc03a3ed1f
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M amplifiers/gemini/gemini.c
    M amplifiers/gemini/gemini.h
    M rigs/gomspace/gs100.c
    M rigs/icom/icom.c
    M rigs/icom/icom.h

  Log Message:
  -----------
  fix(backends): validate bounded parser fields

Stop Icom tuning-step lookup at each table sentinel and bound Gemini status fields without letting truncated scans cancel valid matches. Parse GS100 newline-delimited response lines until its exact non-terminated prompt while enforcing response and line-count limits.

(cherry picked from commit b9b972378f9fbb1b79579d4d1671b713c3786831)


  Commit: 9939978040e64a3b7aeae5f02311dbdfceabfb80
      https://github.com/Hamlib/Hamlib/commit/9939978040e64a3b7aeae5f02311dbdfceabfb80
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M src/misc.c

  Log Message:
  -----------
  fix(core): handle missing band metadata

Check for the BANDSELECT opening delimiter before advancing into the band list in both numeric and string lookup paths.

(cherry picked from commit 86dcae5fd6e852ecea3eb9710b4b7ea92ecd4c7f)


  Commit: cb5b9661e29a567c9880d1d485299029d2603d08
      https://github.com/Hamlib/Hamlib/commit/cb5b9661e29a567c9880d1d485299029d2603d08
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M rigs/yaesu/ftx1/ftx1.h
    M rigs/yaesu/ftx1/ftx1_audio.c
    M rigs/yaesu/ftx1/ftx1_clarifier.c
    M rigs/yaesu/ftx1/ftx1_ext.c

  Log Message:
  -----------
  fix(ftx1): validate physical-device replies

Require exact clarifier and extended-menu response structure, validate numeric conversions and terminators, and reject signed or out-of-range meter values.

(cherry picked from commit d60beb2e638ada12fba55a3ef14d35ed9fb9106c)


  Commit: 8ee11c1075c97bd56880b41d6ccfc7966ae1b421
      https://github.com/Hamlib/Hamlib/commit/8ee11c1075c97bd56880b41d6ccfc7966ae1b421
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M tests/.gitignore
    M tests/Makefile.am
    A tests/testbandmetadata.c
    A tests/testctlbounds.sh
    A tests/testctlparser.c
    A tests/testftx1parsers.c
    A tests/testgeministatus.c
    A tests/testgs100.c
    A tests/testicomts.c

  Log Message:
  -----------
  test(parsers): add boundary regressions

Exercise command stream failures, hexadecimal byte formats, backend truncation and framing, metadata absence, and physical-device reply boundaries with focused valid and malformed cases. Ignore the generated test binaries and harness logs.

(cherry picked from commit 5293dbb8558031f7e2a47aa49b4e4c9b23eb097d)


  Commit: 3ee44369155e6c3760737d5239fddcaf3529dc4b
      https://github.com/Hamlib/Hamlib/commit/3ee44369155e6c3760737d5239fddcaf3529dc4b
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M rigs/yaesu/ftx1/ftx1_audio.c

  Log Message:
  -----------
  refactor(ftx1): simplify S-meter parsing

Suppress the unused P1 conversion result while retaining the response-digit validation performed by the conversion.

(cherry picked from commit 3afe2133a1ef1010478ace1d8c2bb89ff831b70a)


  Commit: 4e03d3813fe89c468766ceed7a555dd531e34bb3
      https://github.com/Hamlib/Hamlib/commit/4e03d3813fe89c468766ceed7a555dd531e34bb3
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M tests/ampctl_parse.c

  Log Message:
  -----------
  fix(ampctl): bound escaped command parsing

Stop binary command decoding at the documented escape boundary and use the conversion endpoint to advance. This avoids reading beyond a terminated command while preserving valid escaped bytes.

(cherry picked from commit 560a44d844d12b5e91110102bd39df1f38086b8b)


  Commit: de0d2424a1d8b375f64269d5ed8b8ff33dcc3f83
      https://github.com/Hamlib/Hamlib/commit/de0d2424a1d8b375f64269d5ed8b8ff33dcc3f83
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M src/misc.c
    M tests/testbandmetadata.c

  Log Message:
  -----------
  fix(core): return generic band for missing metadata

Band-name callers treat successful lookups as printable strings. Return BANDGEN when granularity metadata has no band list instead of propagating NULL into formatting paths.

(cherry picked from commit 489ca77a04e3622e57917e4061e4fa480a9cf238)


  Commit: da2734967d277b6e98dd8c944d48ee34157c47fe
      https://github.com/Hamlib/Hamlib/commit/da2734967d277b6e98dd8c944d48ee34157c47fe
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M rigs/yaesu/ftx1/ftx1.h
    M rigs/yaesu/ftx1/ftx1_audio.c
    M tests/testftx1parsers.c

  Log Message:
  -----------
  fix(ftx1): validate S-meter response framing

Require the response command, VFO selector, numeric payload, and terminator to match the requested S-meter frame. Reject malformed or mismatched replies without changing the output value.

(cherry picked from commit 1f804d4da78954a4413c81d92ace81eec120f569)


  Commit: 703de001709e98a2b1f64a2284960d750afe6040
      https://github.com/Hamlib/Hamlib/commit/703de001709e98a2b1f64a2284960d750afe6040
  Author: David Christle <dch...@us...>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M tests/rotctl_parse.c
    M tests/testctlbounds.sh

  Log Message:
  -----------
  fix(rotctl): bound escaped command parsing

Stop parsing when an escape is missing or consumes no input, and count only successfully decoded bytes. This avoids the extra strtol call beyond the command terminator while preserving valid raw commands.

(cherry picked from commit faefdac4ab8bf6d990b41469cad8692e8544f1af)


  Commit: c3656cee6280a33a80db208c3bd271635adf7fee
      https://github.com/Hamlib/Hamlib/commit/c3656cee6280a33a80db208c3bd271635adf7fee
  Author: Nate Bargmann <n0...@n0...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M amplifiers/gemini/gemini.c
    M amplifiers/gemini/gemini.h
    M rigs/gomspace/gs100.c
    M rigs/icom/icom.c
    M rigs/icom/icom.h
    M rigs/yaesu/ftx1/ftx1.h
    M rigs/yaesu/ftx1/ftx1_audio.c
    M rigs/yaesu/ftx1/ftx1_clarifier.c
    M rigs/yaesu/ftx1/ftx1_ext.c
    M src/misc.c
    M tests/.gitignore
    M tests/Makefile.am
    M tests/ampctl_parse.c
    M tests/rigctl_parse.c
    M tests/rotctl_parse.c
    A tests/testbandmetadata.c
    A tests/testctlbounds.sh
    A tests/testctlparser.c
    A tests/testftx1parsers.c
    A tests/testgeministatus.c
    A tests/testgs100.c
    A tests/testicomts.c

  Log Message:
  -----------
  Merge GitHub PR #2122


  Commit: fc8ec54ac7810a1975581c1e4783815d4c59e516
      https://github.com/Hamlib/Hamlib/commit/fc8ec54ac7810a1975581c1e4783815d4c59e516
  Author: Nate Bargmann <n0...@n0...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M NEWS

  Log Message:
  -----------
  Update NEWS for parser bounds hardening backport


Compare: https://github.com/Hamlib/Hamlib/compare/251815bbe505...fc8ec54ac781

To unsubscribe from these emails, change your notification settings at https://github.com/Hamlib/Hamlib/settings/notifications