Add size validation for OP_SERVERMESSAGE packets - #447
Merged
Conversation
Prevent out-of-bounds read when processing server messages 4 with size < 3, which would cause underflow on the buffer 5 allocation (size-1) and invalid memcpy from packet[2]. Resolves amule-project#445
got3nks
added a commit
to got3nks/amule
that referenced
this pull request
Jul 11, 2026
…e-project#431) (amule-project#447) Collapse hits that are the same file (same ed2k hash AND size) but advertised under different filenames into one expandable parent row, end to end, and let a chosen alternative name be downloaded. Phase 1 - expose grouping: - Core (ExternalConn.cpp): the EC_DETAIL_FULL search responder now descends into GetChildren() and emits each child when the caller opts in with an empty EC_TAG_SEARCH_PARENT flag on the request. amulecmd / amuleweb don't send it, so their flat parents-only list is unchanged; the INC_UPDATE (amulegui) path already emitted children. Children carry their parent's ECID via EC_TAG_SEARCH_PARENT (already in CEC_SearchFile_Tag). - webapi: RefresherTick sends the flag; ApplySearchFull reads EC_TAG_SEARCH_PARENT and folds children into the parent's children[] (name/hash/ecid/sources), dropping them from the top-level set; WriteSearchObject + the search_result_added SSE emit children[] (always present, empty for a single-name hit). Phase 2 - download under a chosen name: - Since grouped children share the parent's hash, hash alone can't pick one. POST /search/results/{hash}/download takes an optional "ecid" (a child's ECID) that rides as an EC_TAG_SEARCHFILE selector; CSearchList::AddFileToDownloadByEcid resolves it across parents + children and downloads that specific result, so the partfile lands under the chosen filename. Omitted => the parent, unchanged. - The download responder now reads the category by name (EC_TAG_PARTFILE_CAT) so the ecid selector can ride alongside it. RefresherTest.SearchResultGroupingFoldsChildren; curl 19 children[] shape + ecid 400; REST + SSE docs. Verified live on a connected daemon (search 'euphoria': 3 grouped parents / 6 children; download 202, ecid-type 400). Frontend rendering is deliberately out of scope.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prevent out-of-bounds read when processing server messages 4 with size < 3, which would cause underflow on the buffer 5 allocation (size-1) and invalid memcpy from packet[2].
Resolves #445