v1.0.5

Update zuptcore

• Resolved high-severity vulnerabilities by removing TOCTOU filesystem races via fd-first open()/fstat() patterns and enforcing non-optimizable secure memory zeroization for cryptographic material.
• TOCTOU in get_device_size() (lines 87, 115): Replaced stat(path) → open(path) with open(path) first → fstat(fd). The fd is bound to the inode at open time and can't be swapped by an attacker.
• Dead-store memset in zupt_x25519() (line 318): Replaced memset(e, 0, 32) with a volatile pointer loop (volatile uint8_t *ve = e; for(...) ve[i] = 0;). The compiler must emit these stores because volatile reads/writes have observable side effects.
• TOCTOU in zupt_disk_restore() (line 601): Replaced stat(target_path) → open(target_path) with open() first → fstat(fd) → fcntl(fd, F_SETFL, O_SYNC) for block devices. Same open-then-classify pattern as the get_device_size fix.
• Verified: 78/78 tests (70 core + 8 disk), ASAN clean, from-scratch tarball build + 100MB ext4 LZHP+PQ roundtrip byte-exact, e2fsck clean
• Shared write_enc_header() eliminates format mismatches across all encryption paths.
• Solid compression now fully supports PQ encryption.
• Disk restore rewritten with block device O_SYNC I/O.
• LZHP disk backups now correctly apply prediction encoding to prevent silent data corruption.
• LZHP Prediction Encoding in Disk Backup
• Fixed zupt_disk_backup() skipping the zupt_predict_encode() step for byte-prediction (pred_active=1).
• Ensures correct prediction encoding before compression to prevent corruption on restore.
• Allocates temporary buffer for prediction-encoded data and frees it after compression.
• Disk backup archives no longer incorrectly set ZUPT_FLAG_SOLID.
• Each block archive is independent, avoiding extraction issues.
• Shared Encryption Header
• write_enc_header() extracted as shared function used by: `zupt_compress_fiprediction encoding to prevent silent data corruption.
• LZHP Prediction Encoding in Disk Backup
• Fixed zupt_disk_backup() skipping the zupt_predict_encode() step for byte-prediction (pred_active=1).
• Ensures correct prediction encoding before compression to prevent corruption on restore.
• Allocates temporary buffer for prediction-encoded data and frees it after compression.
• Spurious SOLID Flag on Disk Archives
• Disk backup archives no longer incorrectly set ZUPT_FLAG_SOLID.
• Each block archive is independent, avoiding extraction issues.
• Shared Encryption Header
• write_enc_header() extracted as shared function used by: zupt_compress_files() zupt_compress_solid() zupt_disk_backup()
• Eliminates mismatches between different encryption paths.
• Block Device Restore I/O
• Uses POSIX raw I/O (open() + write() loop) with O_SYNC, fsync() + sync() for reliable block writes.
• Build Fixes for Termux/Android
• Improved architecture detection using $(CC) -dumpmachine with fallback to uname -m.
• Public API Adjustments
• zupt_w8(), zupt_w16le(), zupt_w64le() now non-static for shared usage.