11 releases 11 tags

RSS feed

• v5.5.3-22 4d79577cc2

  Compare

  v5.5.3-22 Stable

  amnesia released this 2026-07-09 22:25:34 +02:00 | 5 commits to main since this release

  protocol7-core-5.5.3-22

  Security Hardening

  • lainos-notifyd: Replaced strncpy with snprintf for the addr.sun_path assignment. Not an exploitable issue as written (fixed-length string literal into a pre-zeroed buffer, well within bounds) ~ flagged by semgrep's insecure-use-string-copy-fn rule as a false positive, hardened anyway for defense-in-depth and reviewer clarity.

  Security Verification

  • Valgrind memcheck run against lainos-notifyd and lainos-dbus-bridge (via dedicated, non-shipped debug builds with seccomp temporarily disabled through an env-var guard) ~ 0 errors, 0 leaks (definite/indirect/possible) on both, independently cross-validating existing ASAN/dfuzzer/libFuzzer results.
  • cppcheck + semgrep static analysis run against all four daemons (lainos-dbus-bridge.c, lainos-notifyd.c, lainos-init.c, lainos-ghost-units.c) ~ zero errors, zero real security findings. One semgrep finding investigated and confirmed a false positive (see above). A handful of cosmetic style notes (const-correctness, one dead variable in lainos-init.c, one dead variable in lainos-dbus-bridge.c already known from compiler warnings) ~ no functional or security impact.

  Documentation

  • Security analysis document (protocol7-core-security-analysis.md) updated to include Valgrind and static analysis results.

  Downloads

  • protocol7-core-5.5.3-22-x86_64.pkg.tar.zst
    0 downloads · 2026-07-09 22:24:05 +02:00 · 36 KiB
  • protocol7-core-5.5.3-22-x86_64.pkg.tar.zst.sig
    0 downloads · 2026-07-09 22:24:05 +02:00 · 119 B