OScam emu Changelogs
Versıon: 11960- 802
UPTADE: 18.05.2026
11960
webif: drop unused loop counter in pages_gen.c
GCC >= 9 -Wunused-but-set-variable flags the 'i' counter in thestrtok_r dependency loop — only incremented, never read. The two
strtok_r() calls already drive the iteration via the ptr return,
so the counter is dead weight.
Thanks WXbet
OScam emu Changelogs
Versıon: 11961- 802
UPTADE: 120.05.2026
[COLOR=var(--gl-text-color-subtle)]readerconfig.html / readerconfigaio.html:[/COLOR] - Saveemm/Blockemm rows opened <TR> but only closed inner </TD>,
relying on browser auto-close at the next <TR>. Add explicit
</TR> after each </TD>.
config/dvbapi.html:
- Four checkbox rows (Enabled, AU, Enable ecm.info file,
Write detected prov name to srvid) had <TR><TD>...<label></label>
without the closing </TD></TR>. Complete the row markup.
config/gbox.html:
- Line 46: missing </A> in 'Message type:' label
(<A ...>Message type:</TD> -> Message type:</A></TD>).
- Line 71: stray </TR> directly after a fully inline
<TR ...></TR> in the previous line; remove it.
[COLOR=var(--gl-text-color-subtle)]All affected files now have balanced <TR>, <TD> and <A> tags.[/COLOR]
Thanks WXbet
OScam emu Changelogs
Versıon: 11962- 802
UPTADE: 05.06.2026
[COLOR=var(--gl-text-color-subtle)]Validate httpmaxrequestsize through a dedicated config handler.[/COLOR]Reset non-positive values to the default and clamp small positive
values to a minimum of 1024 bytes. Update the docs to reflect the [COLOR=var(--gl-text-color-subtle)]new minimum.[/COLOR]
OScam emu Changelogs
Versıon: 11963- 802
UPTADE: 05.06.2026
[COLOR=var(--gl-text-color-subtle)]* Document cs_inet_ntoa startup-only init guard[/COLOR]
Clarify that inet_ntoa_key_initialized is set during single-threaded
startup and is only a misuse guard, not synchronization for lazy
runtime initialization.
* oscam-net: move cs_inet_ntoa TLS init to startup
Initialize the cs_inet_ntoa TLS key from main() instead of using
pthread_once in the hot path.
Also harden the new startup-based initialization by making
cs_inet_ntoa_init() idempotent, failing fast on use-before-init or
TLS setup failures, and returning the writable buffer on inet_ntop
errors instead of a string literal.
* fix(net): make cs_inet_ntoa thread-safe and IPv6-safe at call sites
The existing cs_inet_ntoa() implementation was not thread-safe:
- with IPV6SUPPORT it returned a single static buffer
- without IPV6SUPPORT it returned inet_ntoa(), which also uses shared static storage
That meant concurrent calls from different threads could overwrite each
other's result. A review comment suggested locking around all callers, but
that would be fragile and easy to miss given the large number of call sites.
This change fixes the problem centrally in cs_inet_ntoa() by replacing the
shared storage with per-thread rotating buffers stored via pthread TLS.
That keeps the existing API intact while making concurrent callers safe.
Changes included:
- add pthread_once/pthread_key based TLS storage for cs_inet_ntoa()
- use a small rotating per-thread buffer set so multiple calls in one
expression/thread can coexist briefly
- replace the IPv4 inet_ntoa() path with inet_ntop(AF_INET, ...)
- handle TLS setup/allocation failure safely by returning an empty string
instead of risking writes through invalid storage
- clear/check inet_ntop() output so failed conversions do not leak stale
data from a reused slot
In addition, clean up several callers and builders that assumed IPv4-sized
address strings:
- widen temporary IP buffers to INET6_ADDRSTRLEN in oscam-client.c,
oscam-cache.c, and oscam-ecm.c
- enlarge the disconnect log buffer in oscam-client.c
- update mk_t_iprange() sizing in oscam-conf-mk.c so serialized ranges have
enough room for full IPv6 addresses
Behavioral notes:
- no caller API changes are required
- cs_inet_ntoa() still returns temporary storage and callers should still
copy the string if they need to keep it
- logs/WebIf/config serialization may now contain full IPv6 addresses where [COLOR=var(--gl-text-color-subtle)] output was previously truncated or racy[/COLOR]
OScam emu Changelogs
Versıon: 11964- 802
UPTADE: 05.06.2026
[COLOR=var(--gl-text-color-subtle)]The WebIf accept loop inherits a 600s SO_RCVTIMEO from[/COLOR]setTCPTimeouts(), which is designed for long-lived reader
connections. For HTTP request handling this is far too generous:
a stalled or dead client can hold a WebIf thread for up to
10 minutes per connection.
Introduce setWebifTCPTimeouts() and call it after setTCPTimeouts()
in http_server(). This overrides three socket options for every
accepted WebIf connection:
SO_RCVTIMEO = 10s bound stalled blocking reads
SO_SNDTIMEO = 10s bound stalled blocking writes
TCP_USER_TIMEOUT = 10s bound unacknowledged TCP data where supported
This keeps the tightened timeouts local to HTTP handling and avoids
changing behavior for readers or other long-lived protocol
connections.
Limitations:
- SO_RCVTIMEO is a per-read idle timeout, not a wall-clock request
deadline. A client trickling data byte-by-byte resets the timer on
every successful read() and can extend the connection indefinitely.
Closing that requires a total request deadline in readRequest().
- For HTTPS, the SSL handshake retry loop uses poll() with an
infinite timeout. SO_RCVTIMEO has no effect there; a client can
still pin a WebIf worker during the handshake phase regardless of
this change.
[COLOR=var(--gl-text-color-subtle)]Co-authored-by: [/COLOR][COLOR=var(--gl-text-color-subtle)]tem_invictus <[email protected]>[/COLOR]
OScam emu Changelogs
Versıon: 11965- 802
UPTADE: 06.06.2026
[COLOR=var(--gl-text-color-subtle)]config/cccreshare.html:[/COLOR] - Escape the raw '->' in the reshare label so the fragment does not trigger a special-character warning.
config/gbox.html:
- Fix the password input markup by separating the name and class attributes.
config/loadbalancer.html:
- Escape raw '->' sequences in Auto Betatunnel mode option labels.
config/webif.html:
- Close the first refresh-row <TD> explicitly before the next table cell.
- Fix malformed empty <A> helper tags in the Show in Status row by adding the missing >.
config/webif_showcacheexinfo.html:
- Fix the malformed helper <A> tag for the CACHEEX info checkbox.
files/menu_gbox.html:
- Add the missing closing </LI> for the gbox files dropdown.
readerconfig/readerconfig_cccambit.html:
- Add missing spaces before version-selection template attributes in <option> tags.
readerconfig/readerconfig_gboxbit.html:
- Fix the password input markup by separating the name and class attributes.
readerconfig/readerconfig_gboxcccresharebit.html:
- Escape raw '->' sequences in CCcam-to-gbox reshare labels.
user_edit/user_edit_cccam.html:
- Escape the literal <-> in the CCcam stealth option text.
[COLOR=var(--gl-text-color-subtle)]All affected files now have balanced or correctly parsed HTML markup.[/COLOR]
OScam emu Changelogs
Versıon: 11966- 802
UPTADE: 26.07.2026
conf-chk: reject invalid ECM header whitelist entries
[COLOR=var(--gl-text-color-subtle) ]tem_invictus[/COLOR][COLOR=var(--gl-text-color-subtle) ] authored [/COLOR]8 hours agochk_ecm_hdr_whitelist() passed header strings to key_atob_l() withoutfully validating them. Odd-length strings could produce partial values,
while decoding failures caused by non-hex characters were ignored and
the resulting entry was still added.
Although the entry structure is initialized for each semicolon-separated
group, failed comma-separated decodes could retain bytes from a previous
header in the same group.
Validate that header strings have an even length before applying the
20-byte size limit. Clear the header buffer before decoding and only add
the entry when key_atob_l() succeeds. Invalid entries are silently
skipped, while the existing truncation behavior for valid oversized
headers is preserved.
Update the "81;zzs;;;;;ab" expectation from "81,00,AB" to "81,AB" and
add regression coverage for odd-length, even-length non-hex, and oversized odd-length headers.
Posting Permissions
Reply With Quote