write_escaped_ch compares the decoded rune against utf8.RuneError to
detect invalid UTF-8, but a literal U+FFFD decodes to that same rune, so
an escaped replacement character was silently deleted. The size returned
by DecodeRuneInString already tells the two apart: invalid bytes decode
with a size of one, a real U+FFFD with a size of three. Keep the rune
when the size is greater than one.
Port the fix from 2093fb131 in the C shlex implementation to the Go one.
Previously an argument such as "" or '' was silently dropped, since an
empty word was also used to signal EOF. So "launch --title '' vim" in the
kitty shell was parsed as "launch --title vim". EOF is now signalled with
a negative Pos.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MA8JGs7pCoXFL2W6jEJ8sD
SplitForCompletion computed the position of the new empty word as if
the previous word were one byte long, so tab completing after a space
following a multi-character word replaced part of that word. For example,
completing "launch --type " in the kitten @ shell produced
"launch --window ". The new word starts at the end of the input.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MA8JGs7pCoXFL2W6jEJ8sD
Timing-safe comparisons:
- crypto.c: Replace memcmp with CRYPTO_memcmp for Secret equality,
require equal lengths before comparing
- remote_control.py: Constant-time password lookup to avoid leaking
valid passwords via dict hash timing
- file_transmission.py: Use hmac.compare_digest for bypass token
comparison instead of ==
Memory safety:
- child-monitor.c: Fix inverted condition in write_to_peer that
prevented memmove from ever executing on partial writes
- ibus_glfw.c: Null-terminate IBUS_ADDRESS copy to prevent string
overread when strlen >= PATH_MAX
- x11_window.c: Add NULL checks after realloc in clipboard/DnD
data handling (two sites)
- dnd.c: Cap accepted_mimes at 1MB to prevent unbounded growth,
fix realloc to not lose the original pointer on failure
- png-reader.c: Cast to size_t before multiplication to prevent
integer overflow on 32-bit platforms
Secrets hygiene:
- disk-cache.c: Zero encryption_key with explicit_bzero before free
Tar extraction hardening:
- tar.go: Validate hardlink targets against destination prefix to
prevent writing outside extraction directory
- tar.go: Strip setuid/setgid/sticky bits from extracted files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
