In unpack_ip_port, data[0] was accessed without verifying that length > 0, causing a potential 1-byte out-of-bounds read on 0-length input. Additionally, checked ip_port and data before dereferencing.
In unpack_nodes, add an entry check verifying nodes is non-null when max_num_nodes > 0.
Added boundary unit tests in auto_tests/network_test.c covering zero-length inputs, truncated IPv4/IPv6 buffers, and invalid address families.
This release fixes a critical bug, other bug fixes and some small features and test improvements.
The critical bug was discovered during a manual audit performed by iphy. You can find more on the issue at https://github.com/TokTok/c-toxcore/security/advisories/GHSA-42vg-9mg3-399f .
Other bug fixes where applied all over the codebase and should result in an even more stable core experience.
A minor noteworthy feature that was added is a function to get a list of group chats, further improving ngc quality of life.
As always, none of the public facing apis (tox.h/toxav.h/toxencryptsave.h/etc) where modified or removed, which should make this update seamless.
Previous code could double-free if more than one dht states per
tox-file and a following allocation fails.
Also changed/removed dead var references in comments.
Add GCA_ANNOUNCE_RESPONSE_MAX_SIZE to capture the true upper bound of
a GCA-extended announce response, and allocate the response buffer
dynamically to match the exact plaintext size rather than using the
non-GCA constant. Update onion_client.c to accept responses up to the
new bound. Add a group announce response size test.
- Drop the MSVC-only `/wd4200` copt that the GNU/zig toolchain rejects.
- Use C++ casts in `ev_test_util.cc` to satisfy `-Wold-style-cast`.
- Refresh the bootstrap node list with live TCP relays; the old ones
no longer respond, so `tcp_relay_test` timed out.
- Shard `tox_network_test` so it fits the test timeout under tsan.
- Pin smatch to 1.74 in sparse.Dockerfile; its HEAD no longer builds.
- Fix the bazel-msan CircleCI target; lossless_packet_test moved to
auto_tests/scenarios/.
Helps the tools and services gain visibility and shows others that we're doing
our best to improve the security, correctness and portability of our code.
Add a `bytes_to_string` function that formats a byte array as hex,
truncating with `...` when the buffer is too small. Replaces the ad-hoc
`id_to_string` in Messenger.c and `data_0`/`data_1` in net_log.c with a
shared helper function.
ClusterFuzzLite batch fuzzing / BatchFuzzing (memory) (push) Failing after 15s
ClusterFuzzLite batch fuzzing / BatchFuzzing (address) (push) Failing after 1m39s
CodeQL / Analyze (cpp) (push) Failing after 1m10s
deploy / Prepare (push) Failing after 1s
deploy / Linux (aarch64) (push) Has been skipped
deploy / Linux (x86_64) (push) Has been skipped
deploy / macOS (arm64) (push) Has been skipped
deploy / macOS (x86_64) (push) Has been skipped
deploy / iOS (ios-arm64) (push) Has been skipped
deploy / iOS (ios-armv7) (push) Has been skipped
deploy / iOS (ios-armv7s) (push) Has been skipped
deploy / iOS (iphonesimulator-arm64) (push) Has been skipped
deploy / iOS (iphonesimulator-x86_64) (push) Has been skipped
deploy / Xcode Framework (push) Has been skipped
deploy / Android (arm64-v8a) (push) Has been skipped
deploy / Android (armeabi-v7a) (push) Has been skipped
deploy / Android (x86) (push) Has been skipped
deploy / Android (x86_64) (push) Has been skipped
deploy / WebAssembly (push) Has been skipped
deploy / Single file (push) Has been skipped
deploy / Source tarball (push) Has been skipped
docker / docker-bootstrap-node (push) Failing after 7s
docker / docker-bootstrap-node-websocket (push) Has been skipped
docker / docker-clusterfuzz (push) Failing after 16s
docker / docker-fuzzer (push) Failing after 11s
docker / docker-esp32 (push) Failing after 12s
docker / docker-windows-mingw (64) (push) Failing after 18s
draft / release (push) Failing after 0s
ClusterFuzzLite batch fuzzing / BatchFuzzing (undefined) (push) Failing after 8s
docker / docker-windows-mingw (32) (push) Failing after 17s
post-submit / build (freebsd) (push) Failing after 28s
post-submit / docker-coverage (push) Failing after 21s
sonar-scan / sonar-scan (push) Failing after 28s
post-submit / build (alpine-s390x) (push) Successful in 57m50s
ClusterFuzzLite cron tasks / Pruning (push) Failing after 1m9s
coverity-scan / latest (push) Failing after 18s
ClusterFuzzLite cron tasks / Coverage (push) Failing after 13s
`msi_call_timeout` synchronously calls callbacks that eventually call
`call_remove`, which frees the `ToxAVCall` object and destroys its
mutex. `iterate_common` was attempting to unlock the mutex after the
call, leading to a Use-After-Free.
Progressive fallbacks for VP8 encoder and decoder in `vc_new` and
`vc_reconfigure_encoder` to handle environments with limited codec
support (e.g., no threading or post-processing).
Also:
- Add a logging callback to `AvTest` to print diagnostic messages to
stderr during tests.
- Upgrade several warnings to errors in `vc_new` and improve error
reporting overall.
See #3022.
Require explicit seeds for `Simulation` and `SimulatedEnvironment` to
ensure reproducible test results.
Also:
- Drop packets in `FakeUdpSocket` when the receive queue is full to
prevent unbounded memory growth during stress tests.
- Improve synchronization in `Simulation::run_until` by adding a timeout
to the barrier wait, preventing hangs if a runner is unregistered.
This release focuses on hardening, architectural refinement, and better testing capabilities.
On the Hardening front, the ToxAV module has undergone significant security improvements. We have addressed a heap buffer overflow in RTP packet handling and fixed several logic bugs in the bandwidth controller and audio modules that could affect stability.
Architectural Refactoring continues with the internalization of core system dependencies. The system clock, random number generation, and memory management are now accessed through abstract interfaces, further decoupling the core from OS-specific implementations and making the codebase more portable and testable.
The test was flaky due to a race condition in moderation event sync:
`wait_for_peer_role` was only checking a peer's self-view of its own
role via mirrored context, rather than ensuring other peers performing
subsequent moderation actions had actually received and processed the
broadcast.
This caused divergent sanctions lists between nodes, leading to `Invalid
credentials hash` warnings and test timeouts when subsequent moderation
actions (like Barrier 5/6) were rejected by nodes that hadn't yet
processed previous updates.
Fixed by using `tox_group_peer_get_role` in `wait_for_peer_role` to
ensure the calling node has locally processed the role update before
proceeding past a synchronization barrier.
This release focuses on hardening, architectural refinement, and better testing capabilities.
On the Hardening front, the ToxAV module has undergone significant security improvements. We have addressed a heap buffer overflow in RTP packet handling and fixed several logic bugs in the bandwidth controller and audio modules that could affect stability.
Architectural Refactoring continues with the internalization of core system dependencies. The system clock, random number generation, and memory management are now accessed through abstract interfaces, further decoupling the core from OS-specific implementations and making the codebase more portable and testable.
The previous logic would only skip nodes if they were both missing an IP
and NOT timed out. This caused Tox to attempt routing packets through
stale or informed but unreachable nodes.
This change ensures we skip any node that either lacks an IP or has
timed out, improving DHT routing reliability.
NoxToxCipher