Security hardening: bound FASL sizes, refuse unsafe socket buffers, shell-quote save-lisp paths (S2–S10 except S1/S6)

[dg1sbg]

Summary

Six small, file-local security fixes addressing pre-existing vulnerabilities at the FASL loader, sockets FFI, save-lisp-and-die build path, exec-environment construction, and the LLVM symbol-lookup callback. Each commit is independent and reviewable on its own.

Threat-model framing

clasp has no internal security boundary by design — loading a FASL is arbitrary code execution, and any Lisp code already has full ext:system / FFI. These fixes therefore matter at real trust boundaries: loading FASLs from a less-trusted source, feeding network bytes to the socket primitives, or passing externally-influenced paths to save-lisp-and-die.

The fixes

commit	issue	fix
loadltv: validate FASL-supplied bignum and array sizes	(S2) op_bignum did mp_limb_t limbs[std::abs(ssize)] — stack VLA sized from a file byte, with std::abs(INT64_MIN) UB and no upper bound. (S7) op_array's total *= dim could overflow size_t then be passed to make_vector/make_mdarray while the per-element fill walked the full unwrapped count → read/write past the buffer	reject INT64_MIN, cap limbs at 1<<20, heap-allocate via std::vector; replace total *= dim with __builtin_mul_overflow and cap at 1<<30 elements
sockets: refuse unsafe buffer types + range-check fd_set fds	(S3/S4) safe_buffer_pointer's (vector t) branch let recvfrom/send scribble raw network bytes over a vector of boxed Lisp pointers (GC heap corruption); its (size+divisor-1)/divisor capacity check wrapped on a negative length cast to uint. (S8) FD_SET/FD_CLR/FD_ISSET from Lisp had no range check, writing/reading out of bounds for fd >= FD_SETSIZE	refuse anything other than strings or (simple-array (unsigned-byte 8)), reject negative size, change the param type to int; range-check fd in all three operators
serve-event: range-check fd_set fds	(S8) same FD_SET/FD_ISSET issue in serve-event's variants	range-check fd
save-lisp-and-die: shell-quote interpolated paths	(S5) system(...) and popen(...) built command lines by string concatenation with filename/_FileName/_LibDir. (save-lisp-and-die :executable t :file "foo; rm -rf ~/work; #") would run the rm at link time	small shell_quote helper (single-quote + escape internal '), wrap every user-controlled value before interpolation; build-time-constant BUILD_LINKFLAGS/BUILD_LIB stay unquoted, and mangled_name is already restricted to [A-Za-z0-9_]
unixsys: terminate env strings before advancing the index	(S9) environ[j]=malloc(...); memcpy(...); j++; environ[j][l]=0; — the NUL-terminate fired after j++, so it wrote into the next, still-uninitialized pointer slot at offset l (wild write) and the actual string was never terminated	move the terminate before j++
Bound the LLVM symbol-lookup callback buffer copy	(S10) strcpy(global_LLVMSymbolLookupCallbackBuffer /* [1024] */, stringstream.str().c_str()) — buffer overflow when dbg_safe_repr emits a long object printout (JIT debug path)	bounded memcpy that truncates to CALLBACK_BUFFER_SIZE-1 and NUL-terminates

What this PR does not do

• (S1) No load-time bytecode verifier. With DEBUG_VIRTUAL_MACHINE off (release), VM bounds checks are compiled out, so a malformed FASL can do anything the VM can do. Adding a verifier is a much larger, separate design project — out of scope here.
• (S6) FASL loader EOF check — already covered by Boot speedup: buffer FASL reads + cache file-scope (~2.6x faster boot) #1775 (the buffered loader errors cleanly on unexpected EOF).

Testing

Full clasp regression suite byte-identical to the pre-change baseline after the combined set: 1877 pass, 0 bus errors / segfaults / memory corruption. (Same 4 pre-existing/expected failures listed in set-unexpected-failures.lisp, unrelated.) The suite exercises FASL loading, the sockets FFI, and save-lisp-and-die paths.

🤖 Generated with Claude Code