Real bugs fixed:
- manager.c: kill_server/stop_server checked fscanf() != EOF, so malformed
pid file content left pid uninitialized and passed it to kill(). Parse
with fgets + ss_parse_int and require pid > 0.
- utils.c: get_default_conf() crashed on strlen(NULL) when HOME is unset
(e.g. daemons started by init) and left a dangling static pointer after
free(), a latent use-after-free on repeated calls. Use a static buffer
and fall back to the system config when HOME is missing.
- local.c: in UDP_ONLY mode, start_ss_local_server() passed uninitialized
listen_ctx.fd to the library callback. Initialize it to -1.
Improvements:
- Replace rand()/srand(time(NULL)) upstream-server selection in ss-local,
ss-redir and ss-tunnel with libsodium randombytes_uniform(): unbiased,
unpredictable, and no seeding required (cert-msc30/msc32).
- Mark FATAL() noreturn so both the compiler and analyzers understand
control flow (removes a family of analyzer false positives).
- Drop two dead stores (manager.c restore_sigchld, udprelay.c src_addr_len).
All remaining findings were verified as false positives and carry NOLINT
comments with rationale (uthash macro internals, symmetric back-pointer
cleanup, analyzer-invisible postconditions). clang-tidy-18 on Linux now
reports zero warnings, so MAX_WARNINGS drops from 29 to 0.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Max Lv
