Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ntop/ndpi

              dev @ f290b81
            

122

Fixes

CVEs

HIGH

Peak severity

57.1%

Coverage

Highlights

Buffer Overflow: 53 prior fixes. Scrutinize any change in this area.

src/lib/protocols/tls.c: most-fixed (28 issues). Treat as high-risk during review.

96 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Buffer Overflow: TLS dissector is the single most-fixed component with 28 fixes spanning heap/stack overflows, OOB reads, integer overflows, and memory corruption in certificate, ALPN, SNI, signature-algorithm, ESNI, and reassembly paths.

Heap Buffer Overflow: HTTP dissector has multiple heap overflows from unchecked strncpy/snprintf/memcmp and missing length validation on content lines, filenames, and server headers.

Buffer Overflow: Core packet parsing and flow management in ndpi_main.c has 14 fixes covering heap/stack overflows, OOB writes, use-after-free, and a detection bypass, indicating systemic issues in shared parsing utilities.