Skip to content

v0.6.1 — Security patch (minutesOfDay overflow guard)

Choose a tag to compare

View all tags
@kiki830621 kiki830621 released this 01 Jun 00:29
v0.6.1
889cf7d

v0.6.1 — Security patch

Fixed

  • Integer-overflow DoS in minutesOfDay (TimetableRouter + MetroTools): caller-supplied depart_after (and malformed timetable/headway data) flowed into h * 60 with no bounds, and Swift traps on overflow — a multi-digit hour crashed the server. Now bounds the HH/mm components before the multiply (which also validates the time). Flagged by automated security review of v0.6.0. (No behavior change for valid input.)

Developer ID signed + Apple notarized.

Assets 6
Loading