SpiceMac 0.1.7

Fixed

• Copying a spreadsheet cell in the guest now pastes onto the Mac. A guest
  copy offers several clipboard representations at once (a cell = UTF-8 text + a
  bitmap image); the guest→host bridge cleared the Mac pasteboard on every write,
  so the representations clobbered each other and only the last survived — usually
  the image, leaving nothing to paste as text. The bridge now clears once per
  guest grab and accumulates the rest, so the cell's text (and image) both land.
  Plain-text copy was unaffected because it's a single type. (Fork change — see
  ThirdParty/CocoaSpice/FORK-NOTES.md.)

Security

• Hardened the .vv parser (the one attacker-influenced file the app opens):
  a 1 MiB file-size cap + UTF-8 enforcement in VVConfig(contentsOf:),
  control-character stripping from values (a NUL in host/proxy would
  otherwise survive Swift validation but truncate inside the C SPICE stack — a
  smuggle), port-range validation (only 1–65535; junk/negative/overflow become
  "absent"), and leading-BOM tolerance. Added a deterministic 20k-iteration
  fuzzer + edge-case tests (vvcheck, now 24 checks) proving the parser never
  crashes on arbitrary input.

Download

SpiceMac.app.zip — Apple Silicon, macOS 12+. Ad-hoc signed; to open: right-click ▸ Open (macOS 14) or System Settings ▸ Privacy & Security ▸ Open Anyway (macOS 15+), or xattr -dr com.apple.quarantine /Applications/SpiceMac.app.

SHA-256: f2aec8992a339d883638ac84007733c1c7726e9ff3ce3e25283f0eec7994b05a