Revert "Merge pull request 'Fix memory/null safety bugs (#74, #72, #69, #64, #60, #50, #49, #65)' (#80) from fix/memory-safety into main"

This reverts commit ddfdb3825a, reversing
changes made to 504a3a4d4f.

src/shared/compression.c

@@ -1,8 +1,7 @@
 #include "compression.h"
 #include "data.h"
 #include "log.h"
-#include <stdint.h>
-#include <stdlib.h>
+#include "stdlib.h"
 #include "zstd.h"
 
 #define INITIAL_DECOMPRESS_BUF_SIZE (1024 * 1024)
@@ -67,16 +66,8 @@ Data* data_decompress(Data* compressed_data) {
     return NULL;
   }
 
-  size_t buf_size = INITIAL_DECOMPRESS_BUF_SIZE;
-  if (!ZSTD_isError(dst_size) && dst_size > 0) {
-    if (dst_size > SIZE_MAX) {
-      log_message(LOG_LEVEL_ERROR,
-                  "Decompressed size %llu exceeds addressable memory, using fallback buffer",
-                  dst_size);
-    } else {
-      buf_size = (size_t)dst_size;
-    }
-  }
+  size_t buf_size =
+      (!ZSTD_isError(dst_size) && dst_size > 0) ? (size_t)dst_size : INITIAL_DECOMPRESS_BUF_SIZE;
   Data* uncompressed_data = data_create_empty(buf_size);
   if (!uncompressed_data) {
     log_message(LOG_LEVEL_ERROR, "Failed to allocate decompression buffer");

src/shared/data.c

@@ -3,9 +3,7 @@
 #include "stdlib.h"
 
 Data* data_create_empty(size_t data_size) {
-  /* malloc(0) is UB; allocate at least 1 byte but preserve requested size */
-  size_t alloc_size = data_size > 0 ? data_size : 1;
-  void* data = malloc(alloc_size);
+  void* data = malloc(data_size);
   if (data == NULL) {
     log_message(LOG_LEVEL_ERROR, "Could not allocate memory for empty data");
     return NULL;

src/shared/protocol.c

@@ -138,10 +138,6 @@ static const char* status_to_string(Status status) {
 }
 
 bool send_str(int file_descriptor, const char* data) {
-  if (data == NULL) {
-    log_message(LOG_LEVEL_ERROR, "send_str called with NULL data");
-    return false;
-  }
   size_t size = strlen(data);
   if (!send_n_data(file_descriptor, &size, sizeof(size_t)))
     return false;
@@ -155,11 +151,6 @@ char* receive_str(int file_descriptor) {
   size_t size;
   if (!receive_n_data(file_descriptor, &size, sizeof(size_t)))
     return NULL;
-  if (size > MAX_STRING_SIZE) {
-    log_message(LOG_LEVEL_ERROR, "receive_str: size %zu exceeds maximum %zu", size,
-                (size_t)MAX_STRING_SIZE);
-    return NULL;
-  }
   char* data = (char*)malloc(size + 1);
   if (data == NULL)
     return NULL;

src/shared/protocol.h

@@ -5,9 +5,6 @@
 #include <stdbool.h>
 #include <stddef.h>
 
-/* Maximum allowed string size for receive_str (10 MB) */
-#define MAX_STRING_SIZE (10 * 1024 * 1024)
-
 typedef struct ssl_st SSL;
 
 typedef int Status;

src/shared/transport_ssh.c

@@ -124,10 +124,7 @@ Client* client_connect_ssh(const char* destination, int port) {
     else
       snprintf(ssh_user, sizeof(ssh_user), "%s", r.host);
 
-    size_t ssh_argv_max = 32;
-    char** ssh_argv = calloc(ssh_argv_max, sizeof(char*));
-    if (ssh_argv == NULL)
-      _exit(1);
+    char* ssh_argv[16];
     int ac = 0;
     char port_str[16];
     ssh_argv[ac++] = "ssh";
@@ -138,24 +135,15 @@ Client* client_connect_ssh(const char* destination, int port) {
     ssh_argv[ac++] = "-o";
     ssh_argv[ac++] = "ControlPath=~/.cache/fastsync-%r@%h:%p";
     if (port > 0 && port != 22) {
-      if ((size_t)ac + 2 >= ssh_argv_max) {
-        free(ssh_argv);
-        _exit(1);
-      }
       ssh_argv[ac++] = "-p";
       snprintf(port_str, sizeof(port_str), "%d", port);
       ssh_argv[ac++] = port_str;
     }
-    if ((size_t)ac + 3 >= ssh_argv_max) {
-      free(ssh_argv);
-      _exit(1);
-    }
     ssh_argv[ac++] = ssh_user;
     ssh_argv[ac++] = "fastsync-server";
     ssh_argv[ac++] = "--stdio";
     ssh_argv[ac] = NULL;
     execvp("ssh", ssh_argv);
-    free(ssh_argv);
     perror("exec of ssh failed");
     ssize_t wret = write(exec_pipe[1], "x", 1);
     (void)wret;

src/shared/utils.c

@@ -10,23 +10,19 @@
 #include <unistd.h>
 
 bool mkdir_r(const char* path) {
-  size_t path_len = strlen(path);
-  char* path_duplicate = malloc(path_len + 1);
+  char* path_duplicate = malloc(strlen(path) + 1);
   if (!path_duplicate)
     return false;
-  memcpy(path_duplicate, path, path_len + 1);
-  /* Buffer for building subpaths: path_len + 1 for leading '/' + 1 for null */
-  size_t buf_size = path_len + 2;
-  char* path_current = (char*)malloc(buf_size);
+  strcpy(path_duplicate, path);
+  char* path_current = (char*)malloc((strlen(path) + 2) * sizeof(char));
   if (!path_current) {
     free(path_duplicate);
     return false;
   }
-  size_t pos = 0;
+  char* path_current_position = path_current;
   if (path[0] == '/') {
-    path_current[0] = '/';
-    path_current[1] = '\0';
-    pos = 1;
+    strcpy(path_current, "/");
+    path_current_position += 1;
   } else {
     path_current[0] = '\0';
   }
@@ -35,16 +31,10 @@ bool mkdir_r(const char* path) {
   const char* part = strtok_r(path_duplicate, delimiter, &saveptr);
   bool ok = true;
   while (part != NULL) {
-    size_t part_len = strlen(part);
-    if (pos + part_len + 1 >= buf_size) {
-      ok = false;
-      break;
-    }
-    memcpy(path_current + pos, part, part_len);
-    pos += part_len;
-    path_current[pos] = '/';
-    pos++;
-    path_current[pos] = '\0';
+    strcpy(path_current_position, part);
+    path_current_position += strlen(part) * sizeof(char);
+    strcpy(path_current_position, "/");
+    path_current_position += sizeof(char);
     struct stat st;
     if (stat(path_current, &st) != 0) {
       if (mkdir(path_current, 0755) != 0) {
@@ -59,6 +49,7 @@ bool mkdir_r(const char* path) {
   free(path_current);
   return ok;
 }
+
 char* str_dup(const char* string) {
   if (string == NULL)
     return NULL;