fix: memory safety — malloc NULL checks, strcpy→memcpy, str_dup NULL check, remove unused include

src/client/scanner.c

@@ -230,6 +230,11 @@ Chunk* directory_scanner_next(DirectoryScanner* scanner) {
       if (link_len >= 0) {
         link_buf[link_len] = '\0';
         file->link_target = str_dup(link_buf);
+        if (file->link_target == NULL) {
+          file_destroy(file);
+          free(cur_path);
+          continue;
+        }
       }
       file->data->size = 0;
       if (scanner->use_metadata)

src/shared/config.c

@@ -14,6 +14,7 @@ Config* config_create(char* version, char* send_directory, char* receive_directo
                       bool use_sendfile, unsigned long long chunk_size) {
 
   Config* config = malloc(sizeof(Config));
+  if (config == NULL) return NULL;
   config->version = version;
   config->send_directory = send_directory;
   config->receive_root_directory = receive_directory;

src/shared/file.c

@@ -37,7 +37,7 @@ File* file_create(const char* path) {
     return NULL;
   }
 
-  strcpy(file->path, path);
+  memcpy(file->path, path, path_len + 1);
   file->data = data_create_reserve(0);
   if (file->data == NULL) {
     free(file->path);
@@ -431,7 +431,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
   if (config->partial && !has_old_file && full_path) {
     char* partial_path = malloc(strlen(full_path) + 20);
     if (partial_path) {
-      sprintf(partial_path, "%s.fastsync-partial", full_path);
+      snprintf(partial_path, strlen(full_path) + 20, "%s.fastsync-partial", full_path);
       has_old_file = (stat(partial_path, &st) == 0);
       if (has_old_file)
         old_size = (unsigned long long)st.st_size;

src/shared/metadata.c

@@ -41,6 +41,7 @@ FileMetadata* metadata_from_buf(char** buf) {
   if (!present)
     return NULL;
   FileMetadata* m = malloc(sizeof(FileMetadata));
+  if (m == NULL) return NULL;
   int32_t mode;
   memcpy(&mode, *buf, sizeof(mode));
   *buf += sizeof(mode);

src/shared/protocol.c

@@ -1,7 +1,6 @@
 #include "protocol.h"
 #include "log.h"
 #include <errno.h>
-#include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <stdio.h>
 #include <stdlib.h>

src/shared/utils.c

@@ -63,7 +63,7 @@ char* str_dup(const char* string) {
   if (string == NULL)
     return NULL;
   char* new_string = (char*)malloc(strlen(string) + 1);
-  strcpy(new_string, string);
+  memcpy(new_string, string, strlen(string) + 1);
   return new_string;
 }