fix: Tighten WS RFC compliance, OAuth2 reentry safety, and HTTP/CI hygiene

- WsClient: reject CR/LF/NUL in upgrade headers; reply 1002 to peer CLOSE
  with reserved (1004/1005/1006/1015) or 1-byte payloads; close 1002 on
  PINGs > 125 bytes and accumulate split PING payloads before PONG echo;
  raise CONNECTTIMEOUT_MS back to 5000; replace assert(sockfd<FD_SETSIZE)
  with a release-safe runtime check; add CURLE_OK-with-zero-progress
  loop guard in sendRaw; route ping() through sendRaw with a 1-byte
  placeholder; QPointer-guard pollRecv re-entry and the queued
  errorOccurred/close pair; gate open() on connectThread.joinable() to
  avoid std::terminate; document idle-only setHeaders contract; add
  removePostedEvents in dtor
- CurlHttpClient: drop CURLOPT_TCP_KEEPALIVE (easy handles are not
  reused); fail the request when curl_slist_append returns null;
  QPointer-guard self in checkCompleted so callback-driven destruction
  is safe; rework writeCallback/headerCallback bound checks to compare
  in size_t against remaining headroom
- OAuth2Client: require a %1 placeholder in the localhost policy and
  re-validate at link() entry; drop the linkingFailed emit on re-entrant
  link() calls so the in-flight flow's terminal signal wins; defer the
  refreshFinished(AuthenticationRequired) emit when refresh() runs on a
  non-owner thread; clear pendingState_ before generating a new state
- HttpRequestInvoker: in dtor, sever both directions of connections and
  call removePostedEvents to evict queued chain dispatches; document the
  mutex-after-requestQueue member-order invariant
- LocalHttpServer: set SO_SNDTIMEO and loop send() until the full
  response is delivered; range-check response.size() against INT_MAX
  before narrowing
- plugin-main: check curl_global_init return code; null-guard the
  settingsDialog show lambda; delete settingsDialog in obs_module_unload
- IngressLinkSource: route the reload-stages connect() through
  guard.data(); log an INFO line when ~IngressLinkSource fires the
  fire-and-forget DELETE so the deferred cleanup is observable
- api-client: log the same fire-and-forget DELETE caveat on terminate()
- utils.hpp: raise GetAdaptersAddresses retry cap from 3 to 5 to absorb
  adapter-state churn between the size probe and data fetch
- CMakeLists.txt: pin Qt6 floor to 6.2; relax the libcurl target check
  to require at least one of libcurl_static / libcurl_object; add
  rationale comments on the OS_* macro origin and Win32 deps
- http-error.hpp: rewrite the Redirect FIXME in English
- run-clang-format / run-cmake-format actions: pass --break-system-packages,
  log the resolved binary path, and anchor the version-pin grep

Author: hanatyan128

.github/actions/run-clang-format/action.yaml

@@ -53,11 +53,11 @@ runs:
           echo ::group::Install clang-format-17
           # PyPI `clang-format` (ssciwr/clang-format-wheel) ships the upstream
           # LLVM 17.0.3 binary, so pinning the version here pins the tool exactly.
-          python3 -m pip install --quiet --user 'clang-format==17.0.3'
-          echo "$(python3 -m site --user-base)/bin" >> $GITHUB_PATH
+          python3 -m pip install --quiet --user --break-system-packages 'clang-format==17.0.3'
           export PATH="$(python3 -m site --user-base)/bin:${PATH}"
+          echo "Resolved clang-format: $(command -v clang-format)"
           clang-format --version
-          clang-format --version | grep -q 'version 17\.0\.3' || {
+          clang-format --version | grep -qE 'version 17\.0\.3([[:space:]]|$)' || {
             echo "::error::clang-format is not pinned to 17.0.3"; exit 1;
           }
           echo ::endgroup::

.github/actions/run-cmake-format/action.yaml

@@ -51,7 +51,13 @@ runs:
 
         if (( ${changes[(I)*.cmake|*CMakeLists.txt]} )) {
           echo ::group::Install cmakelang
-          pip3 install 'cmakelang==0.6.13'
+          python3 -m pip install --quiet --user --break-system-packages 'cmakelang==0.6.13'
+          export PATH="$(python3 -m site --user-base)/bin:${PATH}"
+          echo "Resolved cmake-format: $(command -v cmake-format)"
+          cmake-format --version
+          cmake-format --version | grep -qE '^0\.6\.13$' || {
+            echo "::error::cmake-format is not pinned to 0.6.13"; exit 1;
+          }
           echo ::endgroup::
           echo ::group::Run cmake-format
           ./build-aux/run-cmake-format --fail-${{ inputs.failCondition }} --check

CMakeLists.txt

@@ -4,6 +4,7 @@ include("${CMAKE_CURRENT_SOURCE_DIR}/cmake/common/bootstrap.cmake" NO_POLICY_SCO
 
 # Fail fast on unsupported hosts (FreeBSD/OpenBSD/etc.) before reaching the curl/mbedtls FetchContent block, which would
 # otherwise produce a confusing TLS-backend error instead of a clear platform-support message.
+# OS_WINDOWS / OS_MACOS / OS_LINUX are set by cmake/common/osconfig.cmake (included via bootstrap.cmake).
 if(NOT
    (OS_WINDOWS
     OR OS_MACOS
@@ -71,8 +72,9 @@ if(OS_LINUX)
     URL https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-3.6.3/mbedtls-3.6.3.tar.bz2
     URL_HASH SHA256=64cd73842cdc05e101172f7b437c65e7312e476206e1dbfd644433d11bc56327)
 
-  # CMAKE_POLICY_DEFAULT_<NNNN> survives the nested cmake_minimum_required reset done by curl/mbedtls (cmake_policy(SET)
-  # does not), letting upstream option() / set(... CACHE) honor our function-local overrides.
+  # Use CMAKE_POLICY_DEFAULT_<NNNN> (a variable, scoped to this function and inherited by add_subdirectory) so the OLD-
+  # vs-NEW choice survives the nested cmake_minimum_required(VERSION ...) inside the curl/mbedtls subprojects.
+  # cmake_policy(SET) is stack-pushed and cleared by that reset.
   function(_src_link_setup_mbedtls)
     set(CMAKE_POLICY_DEFAULT_CMP0077 NEW)
     set(CMAKE_POLICY_DEFAULT_CMP0126 NEW)
@@ -115,8 +117,9 @@ FetchContent_Declare(
   URL_HASH SHA256=7b40ea64947e0b440716a4d7f0b7aa56230a5341c8377d7b609649d4aea8dbcf)
 
 function(_src_link_setup_curl)
-  # CMAKE_POLICY_DEFAULT_<NNNN> survives the nested cmake_minimum_required reset done by curl/mbedtls (cmake_policy(SET)
-  # does not), letting upstream option() / set(... CACHE) honor our function-local overrides.
+  # Use CMAKE_POLICY_DEFAULT_<NNNN> (a variable, scoped to this function and inherited by add_subdirectory) so the OLD-
+  # vs-NEW choice survives the nested cmake_minimum_required(VERSION ...) inside the curl subproject.
+  # cmake_policy(SET) is stack-pushed and cleared by that reset.
   set(CMAKE_POLICY_DEFAULT_CMP0077 NEW)
   set(CMAKE_POLICY_DEFAULT_CMP0126 NEW)
   # Belt-and-suspenders: refuse find_package() outright for everything we do not ship, so curl cannot accidentally link
@@ -223,10 +226,10 @@ mbedtls FetchContent targets are missing because _src_link_setup_mbedtls() runs
   # Xcode generator reads CMAKE_XCODE_ATTRIBUTE_* from the top-level directory at generate time rather than from this
   # function's scope, so AppleClang still rejects curl 8.12.1's SIZE_T_MAX uses (-Wambiguous-macro) under -Werror. Force
   # the override per target.
-  if(NOT TARGET libcurl_static OR NOT TARGET libcurl_object)
+  if(NOT TARGET libcurl_static AND NOT TARGET libcurl_object)
     message(
       FATAL_ERROR
-        "curl target names changed — both libcurl_static and libcurl_object are expected; update _src_link_setup_curl() -Werror suppression"
+        "curl target names changed — at least one of libcurl_static or libcurl_object must be defined; update _src_link_setup_curl() -Werror suppression"
     )
   endif()
   foreach(_curl_target IN ITEMS libcurl_static libcurl_object)
@@ -252,6 +255,7 @@ if(OS_LINUX)
   set(SRC_LINK_LINUX_CA_PATH
       "/etc/ssl/certs"
       CACHE STRING "CA bundle path for Linux TLS (directory → CURLOPT_CAPATH, file → CURLOPT_CAINFO)")
+  # Allowlist absolute paths to suppress path traversal and shell metacharacter injection into the embedded macro value.
   if(NOT SRC_LINK_LINUX_CA_PATH MATCHES "^/[A-Za-z0-9._/-]+$")
     message(
       FATAL_ERROR
@@ -262,8 +266,10 @@ if(OS_LINUX)
 endif()
 
 if(OS_WINDOWS)
-  # Winsock + Win32 crypto for the curl Schannel backend. FIXME: verify CURL::libcurl_static INTERFACE deps and drop
-  # redundant entries.
+  # Winsock + Win32 crypto for the curl Schannel backend. ws2_32 / iphlpapi are also required by plugin code itself
+  # (utils.hpp uses winsock2 / iphlpapi for GetAdaptersAddresses; local-http-server.hpp uses winsock2 for the OAuth
+  # loopback server), so they remain mandatory regardless of curl interface deps. FIXME: verify CURL::libcurl_static
+  # INTERFACE deps and drop redundant crypt32 / bcrypt entries.
   target_link_libraries(${CMAKE_PROJECT_NAME} PRIVATE ws2_32 iphlpapi crypt32 bcrypt)
 endif()
 
@@ -278,7 +284,7 @@ if(ENABLE_FRONTEND_API)
 endif()
 
 if(ENABLE_QT)
-  find_package(Qt6 REQUIRED COMPONENTS Widgets Core)
+  find_package(Qt6 6.2 REQUIRED COMPONENTS Widgets Core)
   target_link_libraries(${CMAKE_PROJECT_NAME} PRIVATE Qt6::Core Qt6::Widgets)
   target_compile_options(
     ${CMAKE_PROJECT_NAME} PRIVATE $<$<C_COMPILER_ID:Clang,AppleClang>:-Wno-quoted-include-in-framework-header

src/api-client.cpp

@@ -332,6 +332,7 @@ void SRCLinkApiClient::terminate()
     uplink = QJsonObject();
     // FIXME: fire-and-forget DELETE is canceled by ~CurlHttpClient on shutdown; replace with
     // a sync curl_easy_perform or a bounded QEventLoop pump in a separate PR.
+    INFO_LOG("synchronous shutdown not yet implemented; uplink may remain on server until session timeout");
     deleteUplink(true);
 }
 

src/api-websocket.cpp

@@ -53,10 +53,18 @@ SRCLinkWebSocketClient::SRCLinkWebSocketClient(QUrl _url, SRCLinkApiClient *_api
     client = new WsClient(this);
 
     connect(reconnectTimer, &QTimer::timeout, this, [this]() {
-        reconnectPending = false;
         if (started && !client->isValid()) {
+            // FIXME: WsClient::open() can synchronously emit errorOccurred (e.g. curl_easy_init
+            // failure). Because reconnectPending is cleared after open() returns, that synchronous
+            // error path is suppressed (scheduleReconnect early-returns while pending=true) and the
+            // attempt is not retried. Resolve in a separate PR by routing WsClient::performConnect
+            // failures through Qt::QueuedConnection or splitting reconnectPending into
+            // "scheduled" vs "in-flight" flags.
             open();
+            reconnectPending = false;
             emit reconnecting();
+        } else {
+            reconnectPending = false;
         }
     });
 
@@ -103,10 +111,12 @@ int SRCLinkWebSocketClient::reconnectDelayMs() const
 {
     // Exponential backoff: 10s, 20s, 40s, 80s, 160s, 300s (cap)
     // (reconnectCount is incremented before this is called, so the first delay is BASE_DELAY_MS * 2.)
-    static constexpr int BASE_DELAY_MS = 5000;
-    static constexpr int MAX_DELAY_MS = 300000;
-    int delay = BASE_DELAY_MS * (1 << (std::min)(reconnectCount, 6));
-    return (std::min)(delay, MAX_DELAY_MS);
+    static constexpr qint64 BASE_DELAY_MS = 5000;
+    static constexpr qint64 MAX_DELAY_MS = 300000;
+    // Shift on qint64 to avoid signed-int UB if the shift amount or product ever grows.
+    const qint64 shift = (std::min)(reconnectCount, 6);
+    const qint64 delay = BASE_DELAY_MS * (qint64{1} << shift);
+    return static_cast<int>(std::clamp<qint64>(delay, 0, MAX_DELAY_MS));
 }
 
 // Reconnect signal flow:

src/net/curl-http-client.cpp

@@ -18,6 +18,8 @@ with this program. If not, see <https://www.gnu.org/licenses/>
 
 #include <obs-module.h>
 
+#include <QPointer>
+
 #include "curl-http-client.hpp"
 #include "linux-ca-locations.hpp"
 #include "../plugin-support.h"
@@ -86,8 +88,12 @@ CURL *CurlHttpClient::createEasyHandle(
         QByteArray headerLine = it.key() + ": " + it.value();
         struct curl_slist *next = curl_slist_append(headerList, headerLine.constData());
         if (!next) {
-            obs_log(LOG_WARNING, "CurlHttpClient: curl_slist_append failed for header '%s'", it.key().constData());
-            break;
+            obs_log(LOG_ERROR, "CurlHttpClient: curl_slist_append failed for header '%s'", it.key().constData());
+            if (headerList) {
+                curl_slist_free_all(headerList);
+            }
+            curl_easy_cleanup(easy);
+            return nullptr;
         }
         headerList = next;
     }
@@ -98,6 +104,8 @@ CURL *CurlHttpClient::createEasyHandle(
 
     curl_easy_setopt(easy, CURLOPT_SSL_VERIFYPEER, 1L);
     curl_easy_setopt(easy, CURLOPT_SSL_VERIFYHOST, 2L);
+    // FIXME: Schannel on older Windows 10 builds may negotiate TLS 1.2 only even when MAX_TLSv1_3
+    // is requested. If the server ever mandates TLS 1.3, revisit the Windows support matrix.
     curl_easy_setopt(easy, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_TLSv1_3);
     curl_easy_setopt(easy, CURLOPT_PROTOCOLS_STR, "http,https");
     curl_easy_setopt(easy, CURLOPT_REDIR_PROTOCOLS_STR, "http,https");
@@ -132,10 +140,9 @@ CURL *CurlHttpClient::createEasyHandle(
     }
 #endif
 
+    // Total request timeout (includes connect, TLS handshake, and the full transfer).
     curl_easy_setopt(easy, CURLOPT_TIMEOUT_MS, static_cast<long>(timeoutMs));
-    curl_easy_setopt(easy, CURLOPT_TCP_KEEPALIVE, 1L);
-    curl_easy_setopt(easy, CURLOPT_TCP_KEEPIDLE, 60L);
-    curl_easy_setopt(easy, CURLOPT_TCP_KEEPINTVL, 30L);
+    // TCP keepalive is unnecessary: easy handles are not reused across requests.
     curl_easy_setopt(easy, CURLOPT_PRIVATE, ctx);
     ctx->easy = easy;
 
@@ -278,6 +285,10 @@ void CurlHttpClient::checkCompleted()
     int stillRunning = 0;
     curl_multi_perform(multi, &stillRunning);
 
+    // Guard against the callback synchronously destroying this CurlHttpClient.
+    // After invoking ctx->callback, accessing any member is unsafe unless the guard is alive.
+    QPointer<CurlHttpClient> guard(this);
+
     int msgsInQueue = 0;
     CURLMsg *msg = nullptr;
     while ((msg = curl_multi_info_read(multi, &msgsInQueue)) != nullptr) {
@@ -308,13 +319,19 @@ void CurlHttpClient::checkCompleted()
 
         HttpResponse response{static_cast<int>(statusCode), ctx->responseData, error, ctx->responseHeaders};
 
-        // Detach ctx from activeRequests BEFORE invoking the callback so that any
-        // re-entrant call (e.g. callback issuing a new request) cannot observe a stale
-        // entry, and so cleanupRequest never runs against a ctx the user resurrected.
+        // Detach ctx before the callback so a re-entrant cancelAll() / cancelAllSilently()
+        // cannot double-cleanup this ctx (cancelAllSilently drains via std::move, and both
+        // paths only iterate the ctxs still in activeRequests at the time of the call).
         curl_multi_remove_handle(multi, easy);
         activeRequests.removeOne(ctx);
 
         ctx->callback(response);
+        if (!guard) {
+            // `this` was destroyed during the callback; ctx was already detached from
+            // activeRequests/multi above, so release it and exit without touching members.
+            cleanupRequest(ctx);
+            return;
+        }
         cleanupRequest(ctx);
     }
 
@@ -340,7 +357,12 @@ size_t CurlHttpClient::writeCallback(char *ptr, size_t size, size_t nmemb, void
         return 0;
     }
     size_t totalSize = size * nmemb;
-    if (ctx->responseData.size() + static_cast<qsizetype>(totalSize) > CurlHttpClient::MAX_RESPONSE_SIZE) {
+    // Compare in size_t against the remaining headroom so a huge totalSize cannot
+    // wrap when narrowed to qsizetype before the bound check.
+    const size_t alreadyBuffered = static_cast<size_t>(ctx->responseData.size());
+    // short-circuit: underflow guarded by leading "alreadyBuffered > MAX_RESPONSE_SIZE" check
+    const size_t remainingBudget = static_cast<size_t>(CurlHttpClient::MAX_RESPONSE_SIZE) - alreadyBuffered;
+    if (alreadyBuffered > static_cast<size_t>(CurlHttpClient::MAX_RESPONSE_SIZE) || totalSize > remainingBudget) {
         obs_log(
             LOG_WARNING, "CurlHttpClient: Response exceeded %d bytes limit, aborting", CurlHttpClient::MAX_RESPONSE_SIZE
         );
@@ -362,17 +384,20 @@ size_t CurlHttpClient::headerCallback(char *ptr, size_t size, size_t nmemb, void
         return 0;
     }
     size_t totalSize = size * nmemb;
-    // Aggregate header byte cap: abort when cumulative header bytes (including this chunk)
-    // exceed MAX_HEADER_BYTES. Mirrors the response-body cap in writeCallback.
-    ctx->headerBytesTotal += static_cast<qsizetype>(totalSize);
-    if (ctx->headerBytesTotal > CurlHttpClient::MAX_HEADER_BYTES) {
+    // Aggregate header byte cap. Compare in size_t against remaining headroom so an
+    // oversize totalSize cannot wrap when narrowed to qsizetype before the bound check.
+    const size_t headersSoFar = static_cast<size_t>(ctx->headerBytesTotal);
+    // short-circuit: underflow guarded by leading "headersSoFar > MAX_HEADER_BYTES" check
+    const size_t headerBudget = static_cast<size_t>(CurlHttpClient::MAX_HEADER_BYTES) - headersSoFar;
+    if (headersSoFar > static_cast<size_t>(CurlHttpClient::MAX_HEADER_BYTES) || totalSize > headerBudget) {
         obs_log(
             LOG_WARNING, "CurlHttpClient: Response headers exceeded %lld bytes limit, aborting",
             static_cast<long long>(CurlHttpClient::MAX_HEADER_BYTES)
         );
         ctx->responseTooLarge = true;
         return 0;
     }
+    ctx->headerBytesTotal += static_cast<qsizetype>(totalSize);
     QByteArray line(ptr, static_cast<qsizetype>(totalSize));
     int colonIndex = line.indexOf(':');
     if (colonIndex > 0) {

src/net/http-error.hpp

@@ -23,6 +23,11 @@ with this program. If not, see <https://www.gnu.org/licenses/>
 
 enum class HttpError : int {
     NoError = 0,
+    // FIXME: All 3xx codes are mapped to Redirect on the assumption that the SRC-Link API
+    // never returns 3xx. If endpoints that require redirect following are added later,
+    // implement caller-side handling with a host allowlist and split 304 Not Modified out
+    // as a separate NotModified value so conditional GET can be supported. Tracked for a
+    // follow-up PR.
     Redirect, // HTTP 3xx — surfaced because CURLOPT_FOLLOWLOCATION is disabled
     ConnectionRefused,
     TimeoutError,