From 57aee418ce3f8b2bad77368889fdca133459b3c8 Mon Sep 17 00:00:00 2001 From: Rowan Date: Sun, 26 Jul 2026 16:23:07 -0400 Subject: [PATCH] CLAUDE.md: record the two open defects found while deepening the Debian tests Both #173 (connect-token bounds are assert-only, so release builds write past a stack array) and #174 (parse_address accepts an unterminated bracket) came out of writing behavioural tests against a release build rather than from reading the source. Recording them in the hot block so a future session neither rediscovers them nor "fixes" the packaging test to assert behaviour this library does not currently ship. Co-Authored-By: Claude Opus 5 --- CLAUDE.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 2f8b8c3..0905fd0 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -33,6 +33,21 @@ DECISIONS THAT READ AS BUGS (they are not — do not "fix" them) SECURITY: netcode 1.3.5 and earlier carry the nonce-reuse issue above; see SECURITY.md for affected versions and which channels still serve them. + +KNOWN OPEN DEFECTS -- do not rediscover these, and do not assert them in tests +- #173 `netcode_generate_connect_token` bounds `num_server_addresses` with `netcode_assert` + only. Under `-DNDEBUG` (the release build, and what Debian ships) the asserts vanish and + the parse loops write past a 32-element STACK array. Note the same loop body already + returns NETCODE_ERROR for a bad address string, so the inconsistency is within one + function. Caller-precondition, not attacker-controlled by design -- not filed as an + advisory. +- #174 `netcode_parse_address("[::1")` returns OK and yields `::1`. The opening bracket is + skipped whether or not it was ever closed. The suite already rejects `[`, `[]` and `[]:`, + so this is a gap, not deliberate leniency. Low severity. +Both were found by WRITING TESTS against a release build, not by reading the source. +Neither is asserted in mas-bandwidth/apt's autopkgtest on purpose: the shipped `-DNDEBUG` +library does not promise the first, and the second is unfixed. A packaging test that +asserts an unshipped fix makes a faithful package look broken. # CLAUDE.md