Security hardening: bound FASL sizes, refuse unsafe socket buffers, shell-quote save-lisp paths (S2–S10 except S1/S6)#1776

Open

dg1sbg wants to merge 7 commits into

clasp-developers:mainfrom

dg1sbg:sec/hardening

Commits on Jun 2, 2026

loadltv: validate FASL-supplied bignum and array sizes

dg1sbg
and
claude
committed
sockets: refuse unsafe buffer types + range-check fd_set fds

dg1sbg
and
claude
committed
serve-event: range-check fd_set fds

dg1sbg
and
claude
committed
save-lisp-and-die: shell-quote interpolated paths

dg1sbg
and
claude
committed
unixsys: terminate env strings before advancing the index

dg1sbg
and
claude
committed
Bound the LLVM symbol-lookup callback buffer copy

dg1sbg
and
claude
committed
backtrace: stop strcat-ing a possibly-unterminated libunwind buffer

dg1sbg
and
claude
committed