Skip to content

Qudelix for macOS 1.0.1

Choose a tag to compare

View all tags
@FrankieMa77 FrankieMa77 released this 02 Aug 18:25
· 154 commits to main since this release
v1.0.1
0c9dee5

Security hardening release. No new features, and nothing changes about how the
app talks to the 5K.

A full review of the app found no memory-safety or injection issues — the
protocol parsers were already bounds-checked throughout — but several places
trusted device or network input further than they should have.

Device input

  • A crafted preset segment could make the app display a fabricated EQ curve as
    if the device had reported it. Reassembly now completes only when the preset
    is genuinely covered.
  • Preset names are stripped of control and bidirectional-override characters,
    which could previously reorder text in the popover.
  • Preset index, battery, and volume values are range-checked, and a decoded
    preset is clamped to what the editor can express.
  • Rapid EQ-mode changes are rate-limited so they cannot starve your own volume
    and EQ writes.

Logging

  • ~/Library/Logs/QudelixBar.log is now created private to your user account
    (mode 0600) and will not be written through a symlink planted at that path.
  • Text coming from the device is escaped, so it cannot forge log entries.
  • The log rolls over to .log.1 instead of being wiped at the size limit.

Network

  • The size limits on AutoEq downloads are enforced while the response streams,
    rather than after the whole body has been read into memory.
  • Redirects are pinned to raw.githubusercontent.com.

Bluetooth

Still unused by the app, but hardened ahead of being wired up: the peripheral
is pinned by identifier on first connection, since a BLE advertisement is
entirely controlled by whatever is advertising.

SHA-256 Qudelix-1.0.1.dmg

e56d57f3c9937042071ab3cd12db1f179895b1ac2cfbb4e6baa6e279fb0169f3

The app is signed ad-hoc, not with an Apple Developer ID, so macOS cannot tell
you who built it. Verify your download before opening it:

shasum -a 256 ~/Downloads/Qudelix-1.0.1.dmg

Or, with the .sha256 file downloaded alongside it:

cd ~/Downloads && shasum -a 256 -c Qudelix-1.0.1.dmg.sha256

That should print OK. If it does not, do not open the file.

Requires macOS 14 or later. Universal binary, Apple Silicon and Intel.

Assets 4
Loading