Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 2 commits
- 10 files changed
- 1 contributor
Commits on Jul 18, 2026
-
-
Security hardening of the untrusted-input paths. - web: fix a remotely reachable 1-byte heap-buffer-overflow WRITE in the request reader. The grow check (`len + 4096 > cap`) let len reach exactly cap, so the NUL terminator wrote one past the block for any request with >=8 KB of headers. Confirmed with AddressSanitizer before/after; also check malloc and realloc results instead of using them blind - web: cap a buffered request (headers + body) at 32 MB and reject a Content-Length above it, so a hostile client cannot grow the buffer until the process dies - json: bound parse nesting at 200 levels. xj_parse_value recurses per [ or {, so a deeply nested body exhausted the C stack and killed the process; it is now reported as invalid JSON. Breadth is unaffected - text: reject an overflowing repeat() count. `s.len * n` wrapped, under- allocated, and let the copy loop write far past the block whenever the count came from input Verified: ASan A/B on the overflow, 264 malformed/random HTTP requests and 405 malformed JSON documents under ASan with no reports, plus a new examples/stdlib/hardening_test.xi. Docs: web.md limits. Toolchain 0.1.6.
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff v0.1.5...v0.1.6