Security - #15

Merged

datagutt merged 55 commits into

mainfrom

port/security-remediation

Jun 27, 2026

Commits on Jun 24, 2026

fix(core): guard publisher key against non-sending players
datagutt
committed
cd4e827
fix(core): resolve stat_info/last_read_time/audio-gap data races

andrescera
authored and
datagutt
committed
f1e9b33
fix(conf): own config generation per manager to fix SIGHUP reload UAF

andrescera
authored and
datagutt
committed
e0a1d31
fix(net): fix sls_gethostbyname IPv6 buffer crash and check returns

andrescera
authored and
datagutt
committed
dded8d1
fix(core): harden PID-file creation and open() error checks

andrescera
authored and
datagutt
committed
c953fa0
fix(log): redact player keys and resolved stream ids from logs

andrescera
authored and
datagutt
committed
7d17bce
fix(relay): stop interpreting webhook push URL as a fmt format string

andrescera
authored and
datagutt
committed
e0cfbe7
fix(relay): resolve push-URL DNS off the SRT worker thread

andrescera
authored and
datagutt
committed
edfd0a5
fix(relay): stop leaking stat_info_t and the stock-libsrt setup fd/addrinfo

andrescera
authored and
datagutt
committed
9fe3497
fix(acl): enforce IP ACL for IPv6 peers

andrescera
authored and
datagutt
committed
0135273
fix(relay): guard hash-mode div-by-zero on empty upstreams

andrescera
authored and
datagutt
committed
e4a076c
chore: remove obsolete documentation and configuration files
datagutt
committed
7290dc4
fix(core): correct pat/pmt gating typo in sls_pes2es
datagutt
committed
d1e834d
fix(core): abort on lock failure and cap the auth-reject cache
datagutt
committed
c4bd173
fix(core): make MPEG-TS parser length-driven to remove OOB reads

andrescera
authored and
datagutt
committed
e4055b3
fix(core): return ok from check_ts_info once ts tables are found
datagutt
committed
ae7c28f
feat(http): add http_bind_addr knob for the control plane
datagutt
committed
4dd8162
perf(srt): size receive buffer from bitrate ceiling and latency
datagutt
committed
a2b3edc
fix(core): reference-count CSLSRole to remove cross-thread stats/disconnect UAF

andrescera
authored and
datagutt
committed
647a87d
fix(relay): detach child pushers before freeing dynamic pusher manager (UAF)

andrescera
authored and
datagutt
committed
50da7e8
fix(core): allocate publisher ring after auth + add global stream/memory caps

andrescera
authored and
datagutt
committed
f97d795

Commits on Jun 25, 2026

fix(core): reap un-adopted roles from the worker handoff backlog
datagutt
committed
8467ed5
fix(relay): connect to the vetted push address (DNS-rebinding SSRF)

andrescera
authored and
datagutt
committed
ebd0bbc
build: enable FORTIFY/stack-protector/full-RELRO/PIE/NX hardening

andrescera
authored and
datagutt
committed
565b3a5
chore: low-severity hygiene batch (strlcpy, rlimit, action pins, -Werror)

andrescera
authored and
datagutt
committed
356ff91
build(docker): digest-pin alpine base; conf: security hardening notes
datagutt
committed
8481b4e
fix(ci): key SRT belabox cache on branch HEAD commit hash, not static string

andrescera
authored and
datagutt
committed
4de203a

Commits on Jun 26, 2026

Commits on Jun 27, 2026

chore: clang format
datagutt
committed
7e48429