v2.7.1 - bug fixes, buffer checks

[Kyle]

I cannot thank enough the users who reported bugs and provided patches for this release!

Thanks to the following people for this release:

• Bugs/security:
  • George928
  • leginwos
  • f0rw4rd
  • spiel2001
  • aleks-f
• Patches
  • Aleksandar (aleks-f)
  • VL-80
  • w3lld1

The reported bugs caused me to implement more sanitizers and testing. All locations where we receive byte/element counts from a remote PLC are now checked. Everything found was fixed and tests have been introduced to prevent regressions. There is no real functional change in this release.

A number of infrequent bug failures have been fixed. GitHub's CI runners appear to be over comitted. Some tests now take about 10x longer to run than they did a year ago. These slowdowns exposed more problems with the tests as the number of tests and sanitizers was increased.

Test this release carefully. While the number of lines of code changed were not that high, they were scattered across a number of areas. Move to this or later updates quickly. Releases from 2.7.0 and before have missing checks that can allow remote systems to cause some buffer overflows and similar issues. The attacker would need to either take over a PLC or emulate one.

The increased use of sanitizers and using AI to find potential bugs brought up a number of areas that were not adequately tested.  My next few releases are going to mostly be focused on adding more testing and making sure that test coverage is at least 95%. At least that is the goal.  Happy path tests are not too hard.  Unhappy path tests are a different story.

Let me know if this release has problems that my testing is not uncovering.

Best,

Kyle Hayes