combined security fixes for 3.4.3 release#895

Merged

tridge merged 21 commits into

RsyncProject:masterfrom

tridge:pr-combined-sec-fixes

May 20, 2026

Commits on May 7, 2026

syscall+clientserver: am_chrooted and use_secure_symlinks for daemon-no-chroot (CVE-2026-29518)

tridge
and
claude
committed
sender: fix read-path TOCTOU by opening from module root (CVE-2026-29518)

tridge
and
claude
committed
syscall+receiver: secure receiver-side do_chmod against symlink-race TOCTOU

tridge
and
claude
committed
util1: secure change_dir() against symlink-race chdir-escape

tridge
and
claude
committed
syscall: add symlink-race-safe do_*_at() wrappers and harden secure_relative_open

tridge
and
claude
committed
util1+syscall: secure copy_file source/dest opens; bare-path defence-in-depth

tridge
and
claude
committed
testsuite: end-to-end regression test for chdir-symlink-race

tridge
and
claude
committed
ci(cygwin): mark all symlink-race regression tests as expected-skipped

tridge
and
claude
committed
token: harden compressed-token decoding against integer overflow

tridge
and
claude
committed
testsuite: cover 'refuse options = compress' for the daemon

tridge
and
claude
committed
receiver: add parent_ndx<0 guard, mirroring 797e17f

tridge
and
claude
committed
clientserver: fix hostname ACL bypass when using daemon chroot

tridge
and
claude
committed
defence-in-depth: bound wire-supplied counts and lengths

tridge
and
claude
committed
defence-in-depth: guard cumulative snprintf against length underflow

tridge
and
claude
committed
defence-in-depth: receiver block-index bounds + read_delay_line null check

tridge
and
claude
committed