4 commits

Author	SHA1	Message	Date
m1ngsama	36464007e8	fix(security): implement buffer security enhancements ... - Replace all strcpy() calls with strncpy() to prevent buffer overflows - Add buffer overflow checking in client_printf() vsnprintf result - Implement UTF-8 sequence validation to prevent malformed input - Add utf8_is_valid_sequence() function with complete validation - Enhance read_username() with UTF-8 boundary checks - Add UTF-8 validation for message input handling These changes address: - Buffer overflow vulnerabilities (lines 178, 423, 510) - Insufficient vsnprintf() error checking (line 106) - Missing UTF-8 sequence validation (lines 156-171) Fixes prevent: - Buffer overflow attacks - Overlong UTF-8 encoding exploits - Invalid UTF-8 surrogates injection	2026-01-22 13:54:15 +08:00
m1ngsama	298995aa53	Fix critical memory and concurrency bugs ... Fixes three critical bugs that caused crashes after long-running: 1. Use-after-free race condition in room_broadcast() - Added reference counting to client_t structure - Increment ref_count before using client outside lock - Decrement and free only when ref_count reaches 0 - Prevents accessing freed client memory during broadcast 2. strtok() data corruption in tui_render_command_output() - strtok() modifies original string by replacing delimiters - Now use a local copy before calling strtok() - Prevents corruption of client->command_output 3. Improved handle_key() consistency - Return bool to indicate if key was consumed - Fixes issue where mode-switch keys were processed twice Thread safety changes: - Added client->ref_count and client->ref_lock - Added client_release() for safe cleanup - room_broadcast() now properly increments/decrements refs This fixes the primary cause of crashes during extended operation.	2025-11-30 09:00:00 +08:00
m1ngsama	a4d67be103	Replace telnet with SSH and fix full-screen display ... - Implement SSH server using libssh for secure connections - Replace insecure telnet with encrypted SSH protocol - Add automatic terminal size detection via PTY requests - Support dynamic window resize (SIGWINCH handling) - Fix UI display bug by using SSH channel instead of fd - Update tui_clear_screen to work with SSH connections - Add RSA host key auto-generation on first run - Update README with SSH instructions and security notes - Add libssh dependency to Makefile with auto-detection - Remove all telnet-related code Security improvements: - All traffic now encrypted - Host key authentication - No more plaintext transmission	2025-11-24 16:48:14 +08:00
m1ngsama	63274b92ba	Initial commit	2025-07-01 09:00:00 +08:00