Skip to content

Update STATE.md for #5-#7 security and hostile-input fixes #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
deadp merged 1 commit into from
Oct 22, 2026
Merged

Update STATE.md for #5-#7 security and hostile-input fixes #8

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions STATE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,11 @@ This fork (deadp/strata) is where Joshua's changes are written before they go to

## Now
- Fork synced with upstream on 17-10-2026 (Sync fork): main now has upstream's 0.9.0 release (03-10-2026) plus the fork's STATE.md commit. Ahead/behind counts were not checked because upstream could not be fetched from the runner.
- Tests on synced main: `python -m unittest discover -s tests -p "test_*.py"` ran 1422 tests, OK (14 skipped); `python tests/smoke.py` passed all checks (25 ok lines).
- 21-10-2026 security audit fixes landed on the fork (#5, #6, #7), each also intended as its own upstream PR:
- #5: unlocked BitLocker/LUKS volume keys are no longer written to the case file. The `volume_keys` table and save/get/forget_volume_key are gone, unlocked state is session memory only, and opening a case drops any legacy `volume_keys` table.
- #6: hostile-input allocations are bounded: EWF2 chunk indexes capped by image size, oversized registry log hive sizes/page offsets refused, AFF4 chunk and member inflation capped. PDF `#HH` name escapes are decoded before matching.
- #7: a truncated AFF4 deflate member or chunk is now an error, not silently short data.
- Tests on synced main (before #5-#7; not re-run since): `python -m unittest discover -s tests -p "test_*.py"` ran 1422 tests, OK (14 skipped); `python tests/smoke.py` passed all checks (25 ok lines).
- Joshua has no open PRs on upstream. His 22 PRs there are all merged or closed (latest: browser disk caches, 23-09-2026).
- Upstream CI is green: Fuzz 13-10-2026, CodeQL 12-10-2026. The fork's last CI run was 16-09-2026 and passed.
- Upstream has 9 open issues, mostly feature requests (fuzz corpus, plugin API, localisation, GPS map, fragment carving, memory forensics, FileVault 2).
Expand All @@ -21,8 +25,10 @@ This fork (deadp/strata) is where Joshua's changes are written before they go to
- 18-09-2026: The native crypto sidecar is optional; the core stays dependency-free.
- 02-10-2026: Cross-check Strata against independent readers (libewf and others) on a synthetic corpus.
- 03-10-2026: Upstream cuts 0.9.0 with EWF2 (Ex01) and AFF4 read support.
- 21-10-2026: Volume keys are never persisted in the case file (session memory only), matching the README; old cases lose any stored keys on open.
- 21-10-2026: Parsers treat evidence files as hostile: sizes read from the file are capped before allocating, and truncated compressed data is an error.

## Next action
`Take the open roadmap item "LUKS2 with Argon2 against real cryptsetup images" (docs/ROADMAP.md): build a LUKS2 volume with real cryptsetup, check Strata unlocks it, and tick the item only if it does. Open the PR on the fork first.`

Last updated: 17-10-2026
Last updated: 23-10-2026
Loading