nils/shairport-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update release notes with security bug fixes [skip ci]

Browse Source 
Documented fixes for two security issues in pair_ap/pair-tlv.c and rtsp.c, including bounds checks and validation improvements. Acknowledged contributions from TristanInSec for reporting and fixing the issues.
This commit is contained in:
Mike Brady
2026-06-18 09:36:44 +01:00
committed by GitHub
parent 3780b504a4
commit 486f0d7eb2
1 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RELEASENOTES-DEVELOPMENT.md
+19 -1
View File
@@ -1,4 +1,22 @@
Version
Version 5.1-dev-38-g3780b504
==
**Bug Fixes**
* Fix two security issues reported in [#2215](https://github.com/mikebrady/shairport-sync/issues/2215) and [#2216](https://github.com/mikebrady/shairport-sync/issues/2216):
**pair_ap/pair-tlv.c** (`pair_tlv_parse`):
- Add bounds check before reading type and length bytes
- Fix off-by-one in chunked TLV scan loop
- Add bounds checks inside data copy loop to prevent OOB memcpy
- Add else branch to advance index when size == 0 (prevents infinite loop)
**rtsp.c** (`handle_set_parameter_metadata`):
- Require 8 bytes remaining for tag + length fields
- Validate value length against remaining buffer before read
Many thanks to [TristanInSec](https://github.com/TristanInSec) for reporting the issues and for the [PR](https://github.com/mikebrady/shairport-sync/pull/2218) to fix the problem.
Version 5.1-dev-36-gb4751a09
==
**Bug Fix**
* When an immediate flush is requested, reset the PTP clock anchor information _immediately_ to disable clocking until play is resumed. This prevents occasional apparent sudden jumps in the timing of frames of audio due to using an obsolete clock. It was causing no known problems.