Portable UPnP SDK Files

Security fixes

• GHSA-8pj8-vmhq-qwvj: Cap the MX header of an incoming SSDP M-SEARCH request at 5 seconds, as UDA 1.1 recommends. The reply to a search is scheduled after a random delay in [0, MX) seconds and the queued job keeps a copy of the requester's address, but MX was only checked for being non-negative. A peer could send a stream of searches with a huge MX and pin memory in the timer queue for as long as the process ran (CWE-770). Only devices are affected.
• GHSA-hwrm-c56x-fj22: Fix denial of service of the miniserver worker threads by connections that send nothing. The thread pool did not grow to its maximum for a burst of connections, a connection that sent nothing held a worker for the whole 30 second receive timeout, and a peer could open any number of connections, so a handful of idle connections left no worker for anybody else (CWE-400). The pool now grows while queued jobs outnumber idle threads, a connection has to send its first byte within MINISERVER_FIRST_BYTE_TIMEOUT (5) seconds, and a peer address is limited to MINISERVER_MAX_CONNECTIONS_PER_PEER (6) connections at a time.
• GHSA-f8rh-7wq7-v4m7: Fix a path traversal in the web server on Windows. A backslash in the request path, sent as %5c, is not a separator for remove_dots() but is one for the Windows file system, so /..%5csecret.txt returned a file outside the document root without credentials, and so did NTFS alternate data streams (CWE-22). On Windows a backslash is now treated as a slash before the dots are removed, and a colon is rejected in a path that is mapped onto the file system. Only Windows builds that set a document root are affected.

The advisories will be published shortly.

What's Changed

• fix: free the subscription when ListInit() fails in the SUBSCRIBE handler by @mrjimenez in https://github.com/pupnp/pupnp/pull/643
• fix: harden the ixml DOM mutation API by @mrjimenez in https://github.com/pupnp/pupnp/pull/644
• fix: four web server and API bugs by @mrjimenez in https://github.com/pupnp/pupnp/pull/645
• fix: UpnpFinish() could hang while the miniserver workers were busy by @mrjimenez in https://github.com/pupnp/pupnp/pull/646
• test: give the build tests their own timeout by @mrjimenez in https://github.com/pupnp/pupnp/pull/647

Full Changelog: https://github.com/pupnp/pupnp/compare/release-22.1.7...release-22.1.8