Skip to content

Security fixes - #719

Merged
DigiH merged 2 commits into
theengs:developmentfrom
DigiH:security
Oct 12, 2026
Merged

DigiH merged 2 commits into
theengs:developmentfrom
DigiH:security

Conversation

@DigiH

@DigiH DigiH commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

As reported by Tom Watson

Checklist:

  • The pull request is done against the latest development branch
  • Only one feature/fix was added per PR and the code change compiles without warnings
  • I accept the DCO.

@DigiH
DigiH requested a review from 1technophile October 12, 2026 12:09

@1technophile 1technophile left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes address the reported F1–F5 paths. I replayed 14 cases against 7153ffa with AddressSanitizer and UndefinedBehaviorSanitizer; all completed without sanitizer errors, and valid properties remained available when another data source was truncated.

One remaining improvement: reset errno before strtod() and reject ERANGE afterward. Currently, 1e9999 produces "windspeed":null and 1e-999 produces "windspeed":0 instead of skipping the invalid reading.

@DigiH
DigiH requested a review from 1technophile October 12, 2026 14:08
@DigiH
DigiH merged commit 03b3159 into theengs:development Oct 12, 2026
8 checks passed
@DigiH
DigiH deleted the security branch October 12, 2026 16:25
1technophile added a commit to theengs/app that referenced this pull request Oct 21, 2026
Moves thirdparty/TheengsDecoder from v2.3.0 to v2.5.0, which brings the
upstream fixes from theengs/decoder#719 plus the v2.4.x additions
(Victron SmartShunt / Orion TR / battery monitors, Schneider Odace WLBL,
SwitchBot Meter Pro without CO2, and the "bvpp" primary-property tag).

Co-authored-by: Florian <1technophile@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants