fix: security issues #192 #191 #190 #189 #188 #187

src/client/client_send.c

@@ -25,16 +25,13 @@
 
 #define STREAM_THRESHOLD (64ULL * 1024 * 1024)
 
-/* Forward declaration for progress-reporting thread used in multithreaded send. */
-static int progress_thread_fn(void* arg);
-
 /* Print dry-run manifest showing files that would be transferred. Returns 0 on success. */
 static int send_dry_run_manifest(Config* config) {
   DirectoryScanner* scanner = directory_scanner_create(
       config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
       config->exclude_count, config->include_patterns, config->include_count, config->max_size,
       config->min_size, config->max_depth, config->follow_symlinks, config->copy_links,
-      config->safe_links, config->copy_unsafe_links, false);
+      config->safe_links, config->copy_unsafe_links);
   if (!scanner)
     return -1;
   Chunk* chunk;
@@ -166,7 +163,7 @@ static int send_single_file(Client* client, File* file, Config* config, bool use
   if (!use_incremental) {
     if (use_sendfile) {
       return send_file_direct_sendfile(file, client->file_descriptor, config->use_metadata) ? 0
-                                                                                             : -1;
+                                                                                            : -1;
     }
     return send_file_direct(file, client->file_descriptor, config->use_metadata, compression_level)
                ? 0
@@ -274,9 +271,6 @@ static int send_chunks_multithreaded(void* pipeline_context) {
   if (context->config->transport == TRANSPORT_SSH) {
     if (context->config->use_sendfile) {
       fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
       return 1;
     }
     client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port,
@@ -284,14 +278,11 @@ static int send_chunks_multithreaded(void* pipeline_context) {
   } else if (context->config->use_tls) {
     client = client_create();
     if (!client || !client_connect_tls(client, context->config->server_host,
-                                        context->config->server_port, context->config->tls_cert,
-                                        context->config->tls_key, context->config->tls_ca)) {
+                                       context->config->server_port, context->config->tls_cert,
+                                       context->config->tls_key, context->config->tls_ca)) {
       if (client)
         client_delete(client);
       fprintf(stderr, "Error: could not connect to server via TLS\n");
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
       return thrd_error;
     }
   } else {
@@ -301,18 +292,12 @@ static int send_chunks_multithreaded(void* pipeline_context) {
       if (client)
         client_delete(client);
       fprintf(stderr, "Error: could not connect to server\n");
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
       return thrd_error;
     }
   }
   if (!config_send(client->file_descriptor, context->config)) {
     client_disconnect(client);
     client_delete(client);
-    mtx_lock(&context->mutex_progress);
-    context->sender_done = true;
-    mtx_unlock(&context->mutex_progress);
     return thrd_error;
   }
 
@@ -331,38 +316,19 @@ static int send_chunks_multithreaded(void* pipeline_context) {
       int ok = receive_status(client->file_descriptor, &s) && s == STATUS_OK;
       client_disconnect(client);
       client_delete(client);
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
       return ok ? thrd_success : thrd_error;
 
     send_fail:
       client_disconnect(client);
       client_delete(client);
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
       return thrd_error;
     }
     if (send_chunk(client, current_chunk, context->config) != 0) {
       fprintf(stderr, "Error: unexpected error while sending chunk\n");
       client_disconnect(client);
       client_delete(client);
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
       return thrd_error;
     }
-    if (context->config->show_progress) {
-      unsigned long long chunk_bytes = 0;
-      for (int i = 0; i < current_chunk->element_count; i++) {
-        if (current_chunk->items[i] && current_chunk->items[i]->data)
-          chunk_bytes += current_chunk->items[i]->data->size;
-      }
-      mtx_lock(&context->mutex_progress);
-      context->progress_bytes += chunk_bytes;
-      mtx_unlock(&context->mutex_progress);
-    }
     chunk_destroy(current_chunk);
   }
 }
@@ -374,7 +340,7 @@ static int scan_directory_multithreaded(void* pipeline_context) {
       context->config->exclude_patterns, context->config->exclude_count,
       context->config->include_patterns, context->config->include_count, context->config->max_size,
       context->config->min_size, context->config->max_depth, 4, context->config->follow_symlinks,
-      context->config->copy_links, context->config->safe_links, context->config->copy_unsafe_links, false);
+      context->config->copy_links, context->config->safe_links, context->config->copy_unsafe_links);
 
   Chunk* current_chunk;
   while ((current_chunk = parallel_scanner_next(scanner)) != NULL) {
@@ -432,42 +398,6 @@ static int load_files_multithreaded(void* pipeline_context) {
   }
 }
 
-/* Progress-reporting thread for multithreaded send. Runs in parallel with
-   the scanner/loader/sender threads and prints periodic progress to stderr. */
-static int progress_thread_fn(void* arg) {
-  PipelineContextSender* context = (PipelineContextSender*)arg;
-  time_t last_progress = 0;
-  time_t start = time(NULL);
-
-  while (true) {
-    mtx_lock(&context->mutex_progress);
-    bool done = context->sender_done;
-    unsigned long long total = context->progress_bytes;
-    mtx_unlock(&context->mutex_progress);
-
-    if (done) {
-      time_t now = time(NULL);
-      double elapsed = difftime(now, start);
-      double rate = elapsed > 0.0 ? total / (1048576.0 * elapsed) : 0.0;
-      fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  Done.\n", total / 1048576.0, rate);
-      break;
-    }
-
-    time_t now = time(NULL);
-    if (now - last_progress >= 1) {
-      last_progress = now;
-      double elapsed = difftime(now, start);
-      double rate = elapsed > 0.0 ? total / (1048576.0 * elapsed) : 0.0;
-      fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  ", total / 1048576.0, rate);
-      fflush(stderr);
-    }
-
-    struct timespec ts = {0, 100 * 1000000L}; /* 100 ms */
-    thrd_sleep(&ts, NULL);
-  }
-  return thrd_success;
-}
-
 int send_files(Config* config) {
   if (config->dry_run)
     return send_dry_run_manifest(config);
@@ -485,7 +415,7 @@ int send_files(Config* config) {
   } else if (config->use_tls) {
     client = client_create();
     if (!client || !client_connect_tls(client, config->server_host, config->server_port,
-                                        config->tls_cert, config->tls_key, config->tls_ca)) {
+                                       config->tls_cert, config->tls_key, config->tls_ca)) {
       if (client)
         client_delete(client);
       fprintf(stderr, "Error: could not connect to server via TLS\n");
@@ -509,7 +439,7 @@ int send_files(Config* config) {
       config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
       config->exclude_count, config->include_patterns, config->include_count, config->max_size,
       config->min_size, config->max_depth, config->follow_symlinks, config->copy_links,
-      config->safe_links, config->copy_unsafe_links, false);
+      config->safe_links, config->copy_unsafe_links);
   Chunk* current_chunk;
   unsigned long long total_bytes = 0;
   time_t last_progress = 0;
@@ -617,7 +547,7 @@ int send_files_multithreaded(Config* config) {
   if (config->use_delete)
     context->manifest = array_list_create(free);
 
-  thrd_t scanner, loader, sender, progress;
+  thrd_t scanner, loader, sender;
   if (thrd_create(&scanner, scan_directory_multithreaded, context) != thrd_success ||
       thrd_create(&loader, load_files_multithreaded, context) != thrd_success ||
       thrd_create(&sender, send_chunks_multithreaded, context) != thrd_success) {
@@ -626,26 +556,11 @@ int send_files_multithreaded(Config* config) {
     return 1;
   }
 
-  if (config->show_progress) {
-    if (thrd_create(&progress, progress_thread_fn, context) != thrd_success) {
-      perror("Error creating progress thread.\n");
-      /* Non-fatal; continue without progress reporting */
-    }
-  }
-
   int sender_result;
   thrd_join(scanner, NULL);
   thrd_join(loader, NULL);
   thrd_join(sender, &sender_result);
 
-  if (config->show_progress) {
-    /* Signal progress thread to exit if it hasn't already */
-    mtx_lock(&context->mutex_progress);
-    context->sender_done = true;
-    mtx_unlock(&context->mutex_progress);
-    thrd_join(progress, NULL);
-  }
-
   pipeline_context_sender_destroy(context);
   return sender_result == thrd_success ? 0 : 1;
 }

src/client/scanner.c

@@ -40,7 +40,7 @@ DirectoryScanner* directory_scanner_create(const char* root_directory, bool use_
                                            int include_count, unsigned long long max_size,
                                            unsigned long long min_size, int max_depth,
                                            bool follow_symlinks, bool copy_links, bool safe_links,
-                                           bool copy_unsafe_links, bool checksum) {
+                                           bool copy_unsafe_links) {
   DirectoryScanner* scanner = malloc(sizeof(DirectoryScanner));
   if (scanner == NULL)
     return NULL;
@@ -61,7 +61,6 @@ DirectoryScanner* directory_scanner_create(const char* root_directory, bool use_
   scanner->copy_links = copy_links;
   scanner->safe_links = safe_links;
   scanner->copy_unsafe_links = copy_unsafe_links;
-  scanner->checksum = checksum;
   queue_enqueue(scanner->directories, dir_entry_create(root_directory, 0));
   return scanner;
 }
@@ -277,7 +276,6 @@ typedef struct {
   bool copy_links;
   bool safe_links;
   bool copy_unsafe_links;
-  bool checksum;
 } ParallelWorkerArg;
 
 static int parallel_worker_thread(void* arg) {
@@ -286,7 +284,7 @@ static int parallel_worker_thread(void* arg) {
     DirectoryScanner* ds = directory_scanner_create(
         wa->dirs[i], wa->use_metadata, wa->chunk_size, wa->exclude_patterns, wa->exclude_count,
         wa->include_patterns, wa->include_count, wa->max_size, wa->min_size, wa->max_depth,
-        wa->follow_symlinks, wa->copy_links, wa->safe_links, wa->copy_unsafe_links, wa->checksum);
+        wa->follow_symlinks, wa->copy_links, wa->safe_links, wa->copy_unsafe_links);
     Chunk* chunk;
     while ((chunk = directory_scanner_next(ds)) != NULL) {
       queue_enqueue_multithreaded(wa->ps->result_queue, chunk, &wa->ps->result_mutex,
@@ -309,12 +307,12 @@ static int parallel_worker_thread(void* arg) {
 }
 
 ParallelScanner* parallel_scanner_create(char* root_directory, bool use_metadata,
-                                          unsigned long long chunk_size, char** exclude_patterns,
-                                          int exclude_count, char** include_patterns,
-                                          int include_count, unsigned long long max_size,
-                                          unsigned long long min_size, int max_depth,
-                                          int num_threads, bool follow_symlinks, bool copy_links,
-                                          bool safe_links, bool copy_unsafe_links, bool checksum) {
+                                         unsigned long long chunk_size, char** exclude_patterns,
+                                         int exclude_count, char** include_patterns,
+                                         int include_count, unsigned long long max_size,
+                                         unsigned long long min_size, int max_depth,
+                                         int num_threads, bool follow_symlinks, bool copy_links,
+                                         bool safe_links, bool copy_unsafe_links) {
   ParallelScanner* ps = calloc(1, sizeof(ParallelScanner));
   if (!ps)
     return NULL;
@@ -347,11 +345,63 @@ ParallelScanner* parallel_scanner_create(char* root_directory, bool use_metadata
     char* cur_path = path_cat(root_directory, entry->d_name);
     if (!cur_path)
       continue;
-    struct stat st;
-    if (stat(cur_path, &st) != 0) {
+    struct stat lstats;
+    if (lstat(cur_path, &lstats) != 0) {
       free(cur_path);
       continue;
     }
+    bool is_symlink = S_ISLNK(lstats.st_mode);
+
+    // Skip symlinks unless the user explicitly enabled following/copying them.
+    if (is_symlink && !follow_symlinks && !copy_links && !safe_links &&
+        !copy_unsafe_links) {
+      free(cur_path);
+      continue;
+    }
+
+    // --safe-links: reject symlinks pointing outside the source tree.
+    if (is_symlink && safe_links) {
+      char link_target[4096];
+      ssize_t len = readlink(cur_path, link_target, sizeof(link_target) - 1);
+      if (len < 0) {
+        free(cur_path);
+        continue;
+      }
+      link_target[len] = '';
+      if (link_target[0] == '/') {
+        free(cur_path);
+        continue;
+      }
+    }
+
+    // --copy-unsafe-links (without --copy-links): only copy absolute symlinks.
+    if (is_symlink && copy_unsafe_links && !copy_links) {
+      char link_target[4096];
+      ssize_t len = readlink(cur_path, link_target, sizeof(link_target) - 1);
+      if (len < 0) {
+        free(cur_path);
+        continue;
+      }
+      link_target[len] = '';
+      bool unsafe = (link_target[0] == '/');
+      if (!unsafe) {
+        free(cur_path);
+        continue;
+      }
+    }
+
+    // Determine whether to use lstat or stat results for the entry.
+    struct stat st;
+    bool use_lstat_res = is_symlink && follow_symlinks && !copy_links;
+    if (use_lstat_res) {
+      st = lstats;
+    } else {
+      if (stat(cur_path, &st) != 0) {
+        free(cur_path);
+        continue;
+      }
+    }
+
     if (S_ISDIR(st.st_mode)) {
       array_list_add(subdirs, cur_path);
     } else {
@@ -477,7 +527,6 @@ ParallelScanner* parallel_scanner_create(char* root_directory, bool use_metadata
       wa->copy_links = copy_links;
       wa->safe_links = safe_links;
       wa->copy_unsafe_links = copy_unsafe_links;
-      wa->checksum = checksum;
       start += count;
       if (thrd_create(&ps->threads[t], parallel_worker_thread, wa) != thrd_success) {
         for (int j = 0; j < count; j++)

src/client/scanner.h

@@ -25,7 +25,6 @@ typedef struct {
   bool copy_links;
   bool safe_links;
   bool copy_unsafe_links;
-  bool checksum;
 } DirectoryScanner;
 
 typedef struct {
@@ -46,17 +45,17 @@ DirectoryScanner* directory_scanner_create(const char* root_directory, bool use_
                                            int include_count, unsigned long long max_size,
                                            unsigned long long min_size, int max_depth,
                                            bool follow_symlinks, bool copy_links, bool safe_links,
-                                           bool copy_unsafe_links, bool checksum);
+                                           bool copy_unsafe_links);
 Chunk* directory_scanner_next(DirectoryScanner* scanner);
 void directory_scanner_destroy(DirectoryScanner* scanner);
 
 ParallelScanner* parallel_scanner_create(char* root_directory, bool use_metadata,
-                                          unsigned long long chunk_size, char** exclude_patterns,
-                                          int exclude_count, char** include_patterns,
-                                          int include_count, unsigned long long max_size,
-                                          unsigned long long min_size, int max_depth,
-                                          int num_threads, bool follow_symlinks, bool copy_links,
-                                          bool safe_links, bool copy_unsafe_links, bool checksum);
+                                         unsigned long long chunk_size, char** exclude_patterns,
+                                         int exclude_count, char** include_patterns,
+                                         int include_count, unsigned long long max_size,
+                                         unsigned long long min_size, int max_depth,
+                                         int num_threads, bool follow_symlinks, bool copy_links,
+                                         bool safe_links, bool copy_unsafe_links);
 Chunk* parallel_scanner_next(ParallelScanner* scanner);
 void parallel_scanner_destroy(ParallelScanner* scanner);
 

src/shared/chunk.c

@@ -12,6 +12,9 @@
 #include "metadata.h"
 #include "protocol.h"
 
+/* Maximum individual file data size within a chunk (64 MB) */
+#define MAX_FILE_DATA_SIZE (64ULL * 1024 * 1024)
+
 Chunk* chunk_create(File** items, int element_count) {
   Chunk* chunk = (Chunk*)malloc(sizeof(Chunk));
   if (chunk == NULL) {
@@ -157,6 +160,14 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
       return NULL;
     }
 
+    // Reject individual file data larger than the maximum allowed size.
+    if (file_data_size > MAX_FILE_DATA_SIZE) {
+      log_message(LOG_LEVEL_ERROR, "File data size %zu exceeds maximum %llu",
+                  file_data_size, (unsigned long long)MAX_FILE_DATA_SIZE);
+      array_list_delete(files);
+      return NULL;
+    }
+
     void* file_data = malloc(file_data_size);
     if (file_data == NULL) {
       perror("Could not allocate memory for file data");
@@ -210,6 +221,15 @@ Chunk* receive_chunk_data(int fd, const Config* config) {
       return NULL;
     }
   }
+
+  // Reject chunks larger than the maximum allowed size to prevent OOM.
+  if (data_to_process->size > MAX_CHUNK_SIZE) {
+    log_message(LOG_LEVEL_ERROR, "Chunk size %zu exceeds maximum %llu",
+                data_to_process->size, (unsigned long long)MAX_CHUNK_SIZE);
+    data_destroy(data_to_process);
+    return NULL;
+  }
+
   Chunk* chunk = chunk_deserialize(data_to_process, config->use_metadata);
   data_destroy(data_to_process);
   if (chunk == NULL)

src/shared/config.c

@@ -89,18 +89,6 @@ Config* config_create(void) {
   config->compare_dest = NULL;
   config->copy_dest = NULL;
   config->link_dest = NULL;
-  config->partial_dir = NULL;
-  config->suffix = NULL;
-  config->delete_before = false;
-  config->address = NULL;
-  config->bind_address = NULL;
-  config->ipv6 = false;
-  config->ipv4 = false;
-  config->daemon = false;
-  config->daemon_config = NULL;
-  config->server_mode = false;
-  config->checksum = false;
-  config->compress_choice = NULL;
   return config;
 }
 
@@ -152,18 +140,9 @@ void config_delete(Config* config) {
   free(config->rsh_command);
   free(config->rsync_path);
   free(config->temp_dir);
-  free(config->partial_dir);
-  free(config->suffix);
-  free(config->compress_choice);
   free(config->compare_dest);
   free(config->copy_dest);
   free(config->link_dest);
-  free(config->partial_dir);
-  free(config->suffix);
-  free(config->address);
-  free(config->bind_address);
-  free(config->daemon_config);
-  free(config->compress_choice);
   if (config->filters) {
     array_list_delete(config->filters);
   }
@@ -246,18 +225,6 @@ bool config_send(int file_descriptor, const Config* config) {
   if (!send_str(file_descriptor, config->temp_dir ? config->temp_dir : ""))
     return false;
   Status status;
-  if (!send_int(file_descriptor, config->partial))
-    return false;
-  if (!send_str(file_descriptor, config->partial_dir ? config->partial_dir : ""))
-    return false;
-  if (!send_str(file_descriptor, config->suffix ? config->suffix : ""))
-    return false;
-  if (!send_int(file_descriptor, config->delete_before))
-    return false;
-  if (!send_int(file_descriptor, config->checksum))
-    return false;
-  if (!send_str(file_descriptor, config->compress_choice ? config->compress_choice : ""))
-    return false;
   if (!receive_status(file_descriptor, &status))
     return false;
   if (status != STATUS_OK) {
@@ -392,18 +359,6 @@ Config* config_receive(int file_descriptor) {
   config->compare_dest = NULL;
   config->copy_dest = NULL;
   config->link_dest = NULL;
-  config->partial_dir = NULL;
-  config->suffix = NULL;
-  config->delete_before = false;
-  config->address = NULL;
-  config->bind_address = NULL;
-  config->ipv6 = false;
-  config->ipv4 = false;
-  config->daemon = false;
-  config->daemon_config = NULL;
-  config->server_mode = false;
-  config->checksum = false;
-  config->compress_choice = NULL;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
   config->backup = tmp;
@@ -479,9 +434,6 @@ error:
   free(config->server_host);
   free(config->backup_dir);
   free(config->temp_dir);
-  free(config->partial_dir);
-  free(config->suffix);
-  free(config->compress_choice);
   free(config);
   return NULL;
 }

src/shared/config.h

@@ -100,32 +100,6 @@ typedef struct Config {
   char* compare_dest;
   char* copy_dest;
   char* link_dest;
-
-  // PR #174: Partial transfer resumption
-  char* partial_dir;
-
-  // PR #178: Backup versioning
-  char* suffix;
-
-  // PR #179: Delete policies
-  bool delete_before;
-
-  // PR #181: IPv6 and bind address
-  char* address;
-  char* bind_address;
-  bool ipv6;
-  bool ipv4;
-
-  // PR #182: Daemon/server mode
-  bool daemon;
-  char* daemon_config;
-  bool server_mode;
-
-  // PR #183: Checksum comparison
-  bool checksum;
-
-  // PR #184: Compression algorithm negotiation
-  char* compress_choice;
 } Config;
 
 #define PROTOCOL_VERSION "1.3.0"

src/shared/file.c

@@ -129,28 +129,22 @@ bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
 }
 
 bool file_save_to_disk(const char* root_directory, File* file, const Config* config) {
-  bool backup_enabled = config && config->backup;
-  bool inplace = config && config->inplace;
-  bool sparse = config && config->preserve_sparse;
-  const char* backup_suffix = (config && config->suffix) ? config->suffix : "~";
-  const char* backup_dir = (config && config->backup_dir) ? config->backup_dir : NULL;
-  const char* partial_dir = (config && config->partial_dir) ? config->partial_dir : NULL;
-
+  (void)config;
   if (has_path_traversal(file->path)) {
     log_message(LOG_LEVEL_ERROR, "Path traversal detected in file path: %s", file->path);
     return false;
   }
 
-  char* resolved_root = NULL;
-  const char* actual_root = (partial_dir && config && config->partial) ? partial_dir : root_directory;
-  resolved_root = realpath(actual_root, NULL);
+  // Resolve the destination root to its real path, preventing symlink-based escapes.
+  // If the root does not yet exist, try to create it so realpath can succeed.
+  char* resolved_root = realpath(root_directory, NULL);
   if (resolved_root == NULL) {
-    if (mkdir_r(actual_root)) {
-      resolved_root = realpath(actual_root, NULL);
+    if (mkdir_r(root_directory)) {
+      resolved_root = realpath(root_directory, NULL);
     }
   }
   if (resolved_root == NULL) {
-    log_message(LOG_LEVEL_ERROR, "Failed to resolve destination root: %s", actual_root);
+    log_message(LOG_LEVEL_ERROR, "Failed to resolve destination root: %s", root_directory);
     return false;
   }
 
@@ -160,43 +154,7 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
     return false;
   }
 
-  if (backup_enabled) {
-    struct stat backup_stat;
-    if (stat(disk_path, &backup_stat) == 0) {
-      char* backup_path = NULL;
-      if (backup_dir) {
-        char* resolved_backup_dir = realpath(backup_dir, NULL);
-        if (!resolved_backup_dir) {
-          mkdir_r(backup_dir);
-          resolved_backup_dir = realpath(backup_dir, NULL);
-        }
-        if (resolved_backup_dir) {
-          backup_path = path_cat(resolved_backup_dir, file->path);
-          free(resolved_backup_dir);
-        }
-      }
-      if (!backup_path) {
-        size_t path_len = strlen(disk_path);
-        size_t suffix_len = strlen(backup_suffix);
-        backup_path = malloc(path_len + suffix_len + 1);
-        if (backup_path) {
-          memcpy(backup_path, disk_path, path_len);
-          memcpy(backup_path + path_len, backup_suffix, suffix_len + 1);
-        }
-      }
-      if (backup_path) {
-        char* backup_dir_path = str_dup(backup_path);
-        if (backup_dir_path) {
-          char* bdir = dirname(backup_dir_path);
-          mkdir_r(bdir);
-          free(backup_dir_path);
-        }
-        rename(disk_path, backup_path);
-        free(backup_path);
-      }
-    }
-  }
-
+  // Ensure the target directory exists so the parent can be resolved for path safety.
   char* dir_dup = str_dup(disk_path);
   if (!dir_dup) {
     free(resolved_root);
@@ -204,6 +162,7 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
     return false;
   }
   char* dir_str = dirname(dir_dup);
+  // Create the directory if needed (no-op if it already exists) so realpath can resolve it.
   if (!mkdir_r(dir_str)) {
     free(dir_dup);
     free(resolved_root);
@@ -219,11 +178,13 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
     return false;
   }
 
+  // Verify that the resolved directory is inside the resolved root.
+  // Both are canonical absolute paths — this prevents symlink-based escapes.
   size_t root_len = strlen(resolved_root);
   if (strncmp(resolved_dir, resolved_root, root_len) != 0 ||
       (resolved_dir[root_len] != '\0' && resolved_dir[root_len] != '/')) {
     log_message(LOG_LEVEL_ERROR, "Path escape detected: %s is outside %s", disk_path,
-                actual_root);
+                root_directory);
     free(resolved_dir);
     free(resolved_root);
     free(disk_path);
@@ -232,7 +193,7 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
   free(resolved_dir);
   free(resolved_root);
 
-  bool ok = to_disk(disk_path, file->data->data, file->data->size, inplace, sparse);
+  bool ok = to_disk(disk_path, file->data->data, file->data->size);
   if (ok)
     file_restore_metadata(disk_path, file->metadata);
   free(disk_path);
@@ -517,8 +478,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
   return file;
 }
 
-bool to_disk(const char* path, const void* data, unsigned long long data_size,
-             bool inplace, bool sparse) {
+bool to_disk(const char* path, const void* data, unsigned long long data_size) {
   char* tmp_path = NULL;
   char* directory = NULL;
 
@@ -535,39 +495,6 @@ bool to_disk(const char* path, const void* data, unsigned long long data_size,
   if (!mkdir_r(directory))
     goto done;
 
-  if (inplace) {
-    FILE* file_pointer = fopen(path, "wb");
-    if (file_pointer == NULL) {
-      perror("Could not open file for inplace write");
-      ok = false;
-      goto done;
-    }
-    if (sparse && data_size > 0) {
-      if (fseek(file_pointer, data_size - 1, SEEK_SET) != 0) {
-        perror("Failed to seek for sparse file");
-        fclose(file_pointer);
-        ok = false;
-        goto done;
-      }
-      if (fwrite("", 1, 1, file_pointer) != 1) {
-        perror("Failed to write sparse file");
-        fclose(file_pointer);
-        ok = false;
-        goto done;
-      }
-      rewind(file_pointer);
-    }
-    if (data_size > 0 && fwrite(data, 1, data_size, file_pointer) != data_size) {
-      perror("Failed to write all data to file");
-      fclose(file_pointer);
-      ok = false;
-      goto done;
-    }
-    fclose(file_pointer);
-    free(directory);
-    return true;
-  }
-
   size_t path_len = strlen(path);
   tmp_path = malloc(path_len + 5);
   if (!tmp_path) {
@@ -583,21 +510,6 @@ bool to_disk(const char* path, const void* data, unsigned long long data_size,
     ok = false;
     goto done;
   }
-  if (sparse && data_size > 0) {
-    if (fseek(file_pointer, data_size - 1, SEEK_SET) != 0) {
-      perror("Failed to seek for sparse file");
-      fclose(file_pointer);
-      ok = false;
-      goto done;
-    }
-    if (fwrite("", 1, 1, file_pointer) != 1) {
-      perror("Failed to write sparse file");
-      fclose(file_pointer);
-      ok = false;
-      goto done;
-    }
-    rewind(file_pointer);
-  }
   if (fwrite(data, 1, data_size, file_pointer) != data_size) {
     perror("Failed to write all data to temporary file");
     fclose(file_pointer);
@@ -622,6 +534,13 @@ done:
 
 bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int compression_level,
                         bool send_path) {
+  // sendfile is incompatible with compression (kernel zero-copy).
+  // If compression is requested, fall back to the regular send path.
+  // NOTE: This is a safety net only — callers must ensure compression_level == 0
+  // before calling file_send_sendfile. The fallback to file_send_single_calls
+  // preserves the send_path contract, but callers should not rely on it for
+  // correctness (the --sendfile flag is validated to be mutually exclusive with
+  // -c/--compress at the CLI layer).
   if (compression_level > 0)
     return file_send_single_calls(file, file_descriptor, use_metadata, compression_level,
                                   send_path);

src/shared/file.h

@@ -34,8 +34,7 @@ bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int
 size_t file_content_to_buffer(File* file);
 FileMetadata* file_metadata_create(const struct stat* stats);
 void file_metadata_destroy(void* metadata);
-bool to_disk(const char* path, const void* data, unsigned long long data_size,
-             bool inplace, bool sparse);
+bool to_disk(const char* path, const void* data, unsigned long long data_size);
 bool file_save_to_disk(const char* root_directory, File* file, const Config* config);
 File* receive_incremental_check(int fd, const Config* config, bool* skipped);
 int receive_manifest(int fd, const Config* config, int* next_status);

src/shared/multiprocessing.c

@@ -14,7 +14,7 @@
 #include <threads.h>
 
 PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* queue_scanner,
-                                                       Queue* queue_loader) {
+                                                      Queue* queue_loader) {
   PipelineContextSender* context = malloc(sizeof(PipelineContextSender));
   if (context == NULL)
     return NULL;
@@ -24,14 +24,11 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   context->scanner_done = false;
   context->loader_done = false;
   context->manifest = NULL;
-  context->progress_bytes = 0;
-  context->sender_done = false;
   if (mtx_init(&context->mutex_scanner, mtx_plain) != thrd_success ||
       cnd_init(&context->condition_not_full_scanner) != thrd_success ||
       cnd_init(&context->condition_not_empty_scanner) != thrd_success ||
       mtx_init(&context->mutex_loader, mtx_plain) != thrd_success ||
       cnd_init(&context->condition_not_full_loader) != thrd_success ||
-      mtx_init(&context->mutex_progress, mtx_plain) != thrd_success ||
       cnd_init(&context->condition_not_empty_loader) != thrd_success) {
     perror("Error initializing synchronization objects");
     free(context);
@@ -53,12 +50,11 @@ void pipeline_context_sender_destroy(PipelineContextSender* context) {
   mtx_destroy(&context->mutex_loader);
   cnd_destroy(&context->condition_not_full_loader);
   cnd_destroy(&context->condition_not_empty_loader);
-  mtx_destroy(&context->mutex_progress);
   free(context);
 }
 
 PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue* queue,
-                                                           int file_descriptor, SSL* ssl) {
+                                                          int file_descriptor, SSL* ssl) {
   PipelineContextReceiver* context = malloc(sizeof(PipelineContextReceiver));
   if (context == NULL)
     return NULL;

src/shared/multiprocessing.h

@@ -23,9 +23,6 @@ typedef struct {
   cnd_t condition_not_empty_loader;
   bool loader_done;
   ArrayList* manifest;
-  mtx_t mutex_progress;
-  unsigned long long progress_bytes;
-  bool sender_done;
 } PipelineContextSender;
 
 typedef struct PipelineContextReceiver {
@@ -40,10 +37,10 @@ typedef struct PipelineContextReceiver {
 } PipelineContextReceiver;
 
 PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* queue_scanner,
-                                                       Queue* queue_loader);
+                                                      Queue* queue_loader);
 void pipeline_context_sender_destroy(PipelineContextSender* context);
 PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue* queue_receiver,
-                                                           int file_descriptor, SSL* ssl);
+                                                          int file_descriptor, SSL* ssl);
 void pipeline_context_receiver_destroy(PipelineContextReceiver* context);
 int receive_thread(void* pipeline_context);
 int write_thread(void* pipeline_context);

src/shared/protocol.h

@@ -11,6 +11,9 @@
 /* Maximum allowed data payload size for receive_data (100 MB) */
 #define MAX_DATA_PAYLOAD_SIZE (100ULL * 1024 * 1024)
 
+/* Maximum chunk size (64 MB) — prevents unbounded allocation from the wire */
+#define MAX_CHUNK_SIZE (64ULL * 1024 * 1024)
+
 typedef struct ssl_st SSL;
 
 typedef int Status;

src/shared/transport_ssh.c

@@ -182,7 +182,7 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
     return NULL;
   }
   client->file_descriptor = sv[0];
-  client->address.ss_family = AF_UNIX;
+  client->address.sin_family = AF_UNIX;
   client->address_length = 0;
   client->ssh_child_pid = pid;
   client->ssl = NULL;

src/shared/transport_tcp.c

@@ -3,7 +3,6 @@
 #include "protocol.h"
 #include <arpa/inet.h>
 #include <errno.h>
-#include <netdb.h>
 #include <openssl/ssl.h>
 #include <signal.h>
 #include <stdio.h>
@@ -144,10 +143,6 @@ void tcp_set_timeouts(int timeout_sec, int contimeout_sec) {
     g_contimeout_sec = contimeout_sec;
 }
 
-int tcp_get_contimeout_sec(void) {
-  return g_contimeout_sec;
-}
-
 static void tcp_apply_socket_timeout(int fd) {
   struct timeval tv;
   tv.tv_sec = g_timeout_sec;
@@ -157,12 +152,19 @@ static void tcp_apply_socket_timeout(int fd) {
 }
 
 Client* client_create() {
-  Client* client = (Client*)malloc(sizeof(Client));
-  if (client == NULL) {
+  int file_descriptor = socket(AF_INET, SOCK_STREAM, 0);
+  if (file_descriptor < 0) {
+    perror("Could not create Socket!");
     return NULL;
   }
-  client->file_descriptor = -1;
-  memset(&client->address, 0, sizeof(client->address));
+
+  Client* client = (Client*)malloc(sizeof(Client));
+  if (client == NULL) {
+    close(file_descriptor);
+    return NULL;
+  }
+  client->file_descriptor = file_descriptor;
+  client->address.sin_family = AF_INET;
   client->address_length = sizeof(client->address);
   client->ssh_child_pid = -1;
   client->ssl = NULL;
@@ -171,50 +173,23 @@ Client* client_create() {
 }
 
 bool client_connect(Client* client, char* host, int port) {
-  struct addrinfo hints;
-  struct addrinfo* result;
-  memset(&hints, 0, sizeof(hints));
-  hints.ai_family = AF_UNSPEC;
-  hints.ai_socktype = SOCK_STREAM;
-  hints.ai_protocol = IPPROTO_TCP;
+  client->address.sin_port = htons(port);
+  client->address.sin_family = AF_INET;
+  client->address_length = sizeof(client->address);
 
-  char port_str[16];
-  snprintf(port_str, sizeof(port_str), "%d", port);
-
-  int err = getaddrinfo(host, port_str, &hints, &result);
-  if (err != 0 || result == NULL) {
-    fprintf(stderr, "Could not resolve host: %s (%s)\n", host, gai_strerror(err));
+  if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
+    perror("Could not convert host address!");
     return false;
   }
 
-  struct addrinfo* rp;
-  bool connected = false;
-  for (rp = result; rp != NULL; rp = rp->ai_next) {
-    if (client->file_descriptor >= 0)
-      close(client->file_descriptor);
+  struct timeval ct;
+  ct.tv_sec = g_contimeout_sec;
+  ct.tv_usec = 0;
+  setsockopt(client->file_descriptor, SOL_SOCKET, SO_RCVTIMEO, &ct, sizeof(ct));
+  setsockopt(client->file_descriptor, SOL_SOCKET, SO_SNDTIMEO, &ct, sizeof(ct));
 
-    client->file_descriptor = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
-    if (client->file_descriptor < 0)
-      continue;
-
-    struct timeval ct;
-    ct.tv_sec = g_contimeout_sec;
-    ct.tv_usec = 0;
-    setsockopt(client->file_descriptor, SOL_SOCKET, SO_RCVTIMEO, &ct, sizeof(ct));
-    setsockopt(client->file_descriptor, SOL_SOCKET, SO_SNDTIMEO, &ct, sizeof(ct));
-
-    memcpy(&client->address, rp->ai_addr, rp->ai_addrlen);
-    client->address_length = rp->ai_addrlen;
-
-    if (connect(client->file_descriptor, (struct sockaddr*)&client->address,
-                client->address_length) == 0) {
-      connected = true;
-      break;
-    }
-  }
-  freeaddrinfo(result);
-
-  if (!connected) {
+  if (connect(client->file_descriptor, (struct sockaddr*)&client->address, client->address_length) <
+      0) {
     perror("Could not connect to Server!");
     return false;
   }
@@ -230,10 +205,7 @@ void client_disconnect(Client* client) {
     client->ssl = NULL;
     io_set_ssl(NULL);
   }
-  if (client->file_descriptor >= 0) {
-    close(client->file_descriptor);
-    client->file_descriptor = -1;
-  }
+  close(client->file_descriptor);
   if (client->ssh_child_pid > 0) {
     int status;
     waitpid(client->ssh_child_pid, &status, 0);

src/shared/transport_tcp.h

@@ -15,7 +15,7 @@ typedef struct Server {
 } Server;
 
 typedef struct Client {
-  struct sockaddr_storage address;
+  struct sockaddr_in address;
   unsigned int address_length;
   int file_descriptor;
   pid_t ssh_child_pid;
@@ -33,6 +33,5 @@ bool client_connect(Client* client, char* host, int port);
 void client_disconnect(Client* client);
 void client_delete(Client* client);
 void tcp_set_timeouts(int timeout_sec, int contimeout_sec);
-int tcp_get_contimeout_sec(void);
 
 #endif

src/shared/transport_tls.c

@@ -3,7 +3,6 @@
 #include "protocol.h"
 #include "transport_tcp.h"
 #include <arpa/inet.h>
-#include <netdb.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <signal.h>
@@ -149,50 +148,13 @@ bool server_listen_tls(Server* server, void (*handler)(int file_descriptor)) {
 
 bool client_connect_tls(Client* client, char* host, int port, const char* cert_path,
                         const char* key_path, const char* ca_path) {
-  struct addrinfo hints;
-  struct addrinfo* result;
-  memset(&hints, 0, sizeof(hints));
-  hints.ai_family = AF_UNSPEC;
-  hints.ai_socktype = SOCK_STREAM;
-  hints.ai_protocol = IPPROTO_TCP;
-
-  char port_str[16];
-  snprintf(port_str, sizeof(port_str), "%d", port);
-
-  int err = getaddrinfo(host, port_str, &hints, &result);
-  if (err != 0 || result == NULL) {
-    fprintf(stderr, "Could not resolve host: %s (%s)\n", host, gai_strerror(err));
+  client->address.sin_port = htons(port);
+  if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
+    perror("Could not convert host address!");
     return false;
   }
-
-  struct addrinfo* rp;
-  bool connected = false;
-  for (rp = result; rp != NULL; rp = rp->ai_next) {
-    if (client->file_descriptor >= 0)
-      close(client->file_descriptor);
-
-    client->file_descriptor = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
-    if (client->file_descriptor < 0)
-      continue;
-
-    struct timeval ct;
-    ct.tv_sec = tcp_get_contimeout_sec();
-    ct.tv_usec = 0;
-    setsockopt(client->file_descriptor, SOL_SOCKET, SO_RCVTIMEO, &ct, sizeof(ct));
-    setsockopt(client->file_descriptor, SOL_SOCKET, SO_SNDTIMEO, &ct, sizeof(ct));
-
-    memcpy(&client->address, rp->ai_addr, rp->ai_addrlen);
-    client->address_length = rp->ai_addrlen;
-
-    if (connect(client->file_descriptor, (struct sockaddr*)&client->address,
-                client->address_length) == 0) {
-      connected = true;
-      break;
-    }
-  }
-  freeaddrinfo(result);
-
-  if (!connected) {
+  if (connect(client->file_descriptor, (struct sockaddr*)&client->address, client->address_length) <
+      0) {
     perror("Could not connect to Server!");
     return false;
   }

tests/test_scanner.c

@@ -19,7 +19,7 @@ static void test_scanner_single_file() {
   create_test_file(file1, content1);
 
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   Chunk* chunk = directory_scanner_next(scanner);
@@ -48,7 +48,7 @@ static void test_scanner_multiple_files() {
   create_test_file(file2, content2);
 
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   const Chunk* chunk = directory_scanner_next(scanner);
@@ -88,7 +88,7 @@ static void test_scanner_subdirectory() {
   create_test_file(sub_file, content);
 
   DirectoryScanner* scanner = directory_scanner_create((char*)root, false, 0, NULL, 0, NULL, 0, 0,
-                                                       0, 0, false, false, false, false, false);
+                                                       0, 0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   int total_files = 0;
@@ -112,7 +112,7 @@ static void test_scanner_empty_directory() {
   EXPECT_EQ_INT(mkdir(dir, 0755), 0);
 
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   const Chunk* chunk = directory_scanner_next(scanner);
@@ -136,7 +136,7 @@ static void test_scanner_exclude_pattern() {
 
   char* exclude[] = {"*.tmp"};
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, exclude, 1, NULL, 0, 0,
-                                                       0, 0, false, false, false, false, false);
+                                                       0, 0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   Chunk* chunk = directory_scanner_next(scanner);
@@ -169,7 +169,7 @@ static void test_scanner_exclude_subdirectory() {
 
   char* exclude[] = {"*.tmp"};
   DirectoryScanner* scanner = directory_scanner_create((char*)root, false, 0, exclude, 1, NULL, 0,
-                                                       0, 0, 0, false, false, false, false, false);
+                                                       0, 0, 0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   int total = 0;
@@ -207,7 +207,7 @@ static void test_scanner_include_and_exclude() {
   char* exclude[] = {"*.bak"};
   char* include[] = {"*.txt", "*.log"};
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, exclude, 1, include, 2,
-                                                       0, 0, 0, false, false, false, false, false);
+                                                       0, 0, 0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   Chunk* chunk = directory_scanner_next(scanner);
@@ -244,7 +244,7 @@ static void test_scanner_max_size() {
 
   /* max_size = 10 — only files <= 10 bytes */
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 10,
-                                                       0, 0, false, false, false, false, false);
+                                                       0, 0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   Chunk* chunk = directory_scanner_next(scanner);
@@ -272,7 +272,7 @@ static void test_scanner_min_size() {
 
   /* min_size = 1 — only files >= 1 byte */
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 1,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   Chunk* chunk = directory_scanner_next(scanner);
@@ -302,7 +302,7 @@ static void test_scanner_size_range() {
 
   /* Only files between 3 and 20 bytes */
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 20,
-                                                       3, 0, false, false, false, false, false);
+                                                       3, 0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   Chunk* chunk = directory_scanner_next(scanner);
@@ -338,7 +338,7 @@ static void test_scanner_mixed_patterns() {
   char* exclude[] = {"*.bak"};
   char* include[] = {"*.txt"};
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, exclude, 1, include, 1,
-                                                       10, 3, 0, false, false, false, false, false);
+                                                       10, 3, 0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   Chunk* chunk = directory_scanner_next(scanner);
@@ -369,7 +369,7 @@ static void test_scanner_no_patterns() {
   create_test_file(f2, "second");
 
   DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
   EXPECT_NOT_NULL(scanner);
 
   Chunk* chunk = directory_scanner_next(scanner);

tests/test_transport_tcp.c

@@ -23,8 +23,8 @@ static void test_server_delete_null() {
 static void test_client_create() {
   Client* c = client_create();
   EXPECT_NOT_NULL(c);
-  EXPECT_TRUE(c->file_descriptor == -1);
-  EXPECT_EQ_INT(c->address.ss_family, 0);
+  EXPECT_TRUE(c->file_descriptor >= 0);
+  EXPECT_EQ_INT(c->address.sin_family, AF_INET);
   EXPECT_EQ_INT(c->ssh_child_pid, -1);
   EXPECT_NULL(c->ssl);
   EXPECT_NULL(c->ssl_ctx);