From 2d0ef039b77d460f761b39090f45c117541578cb Mon Sep 17 00:00:00 2001
From: Scott Zager <scott.zager@gmail.com>
Date: Sat, 18 Jul 2026 20:06:04 -0400
Subject: [PATCH] fix: defensive hardening across C backend

- generateReceiverJson: replace sprintf with safe_snprintf
- Beast escape scan: add sanity limit on eom growth
- view1090: check strdup return value
- demod_2400: replace assert with runtime check for signal power overlap

Fixes #309
---
 demod_2400.c |  5 ++++-
 net_io.c     | 12 ++++++++----
 view1090.c   |  4 ++++
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/demod_2400.c b/demod_2400.c
index d6d90e036..cd3c03d8c 100644
--- a/demod_2400.c
+++ b/demod_2400.c
@@ -118,7 +118,10 @@ void demodulate2400(struct mag_buf *mag)
     int bestscore, bestphase;
 
     // maximum lookahead we use
-    assert(mag->overlap >= 19 + 1 + 269);
+    if (mag->overlap < 19 + 1 + 269) {
+        fprintf(stderr, "insufficient overlap for signal power measurement\n");
+        return;
+    }
 
     uint16_t *m = mag->data;
     uint32_t mlen = mag->validLength - mag->overlap;
diff --git a/net_io.c b/net_io.c
index 8abd51086..65721dd73 100644
--- a/net_io.c
+++ b/net_io.c
@@ -2079,6 +2079,7 @@ char *generateStatsJson(const char *url_path, int *len) {
 char *generateReceiverJson(const char *url_path, int *len)
 {
     char *buf = (char *) malloc(1024), *p = buf;
+    char *end = buf + 1024;
     int history_size;
 
     MODES_NOTUSED(url_path);
@@ -2089,7 +2090,7 @@ char *generateReceiverJson(const char *url_path, int *len)
     else
         history_size = HISTORY_SIZE;
 
-    p += sprintf(p, "{ " \
+    p = safe_snprintf(p, end, "{ " \
                  "\"version\" : \"%s\", "
                  "\"refresh\" : %.0f, "
                  "\"history\" : %d",
@@ -2097,19 +2098,19 @@ char *generateReceiverJson(const char *url_path, int *len)
 
     if (Modes.json_location_accuracy && (Modes.fUserLat != 0.0 || Modes.fUserLon != 0.0)) {
         if (Modes.json_location_accuracy == 1) {
-            p += sprintf(p, ", "                \
+            p = safe_snprintf(p, end, ", "                \
                          "\"lat\" : %.2f, "
                          "\"lon\" : %.2f",
                          Modes.fUserLat, Modes.fUserLon);  // round to 2dp - about 0.5-1km accuracy - for privacy reasons
         } else {
-            p += sprintf(p, ", "                \
+            p = safe_snprintf(p, end, ", "                \
                          "\"lat\" : %.6f, "
                          "\"lon\" : %.6f",
                          Modes.fUserLat, Modes.fUserLon);  // exact location
         }
     }
 
-    p += sprintf(p, " }\n");
+    p = safe_snprintf(p, end, " }\n");
 
     *len = (p - buf);
     return buf;
@@ -2324,6 +2325,9 @@ static void modesReadFromClient(struct client *c) {
                     if (0x1A == *p) {
                         p++;
                         eom++;
+                        if (eom > eod + MODES_LONG_MSG_BYTES) {
+                            break; // Sanity limit
+                        }
                     }
                 }
 
diff --git a/view1090.c b/view1090.c
index 9ba848f0f..c1314c4b1 100644
--- a/view1090.c
+++ b/view1090.c
@@ -187,6 +187,10 @@ int main(int argc, char **argv) {
             }
         } else if (!strcmp(argv[j], "--interactive-callsign-filter") && more) {
             Modes.interactive_callsign_filter = strdup(argv[++j]);
+            if (!Modes.interactive_callsign_filter) {
+                fprintf(stderr, "out of memory\n");
+                exit(1);
+            }
         } else if (!strcmp(argv[j], "--lat") && more) {
             Modes.fUserLat = atof(argv[++j]);
         } else if (!strcmp(argv[j],"--lon") && more) {