Nick Craig-Wood ab1f458013 serve s3: reject bogus multipart part sizes in the reorder buffer GHSA-2p48-j3qc-rx9f ...

The multipart reorder-buffer admission trusted the client-declared part length.
A negative length was accepted, and `buffered + size` could overflow int64 for
a huge declared length, wrapping the running total negative and admitting
further parts past --multipart-streaming-buffer-limit.

Reject a negative length and use the overflow-safe comparison `size <=
bufferLimit - buffered` so an untrusted Content-Length can neither poison nor
overflow the budget.

(cherry picked from commit 337ab7f76ba6ba3731fba04b088bd831511bca04)

2026-09-04 16:18:18 +01:00

..

about

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

all

gui: new command to launch the https://github.com/rclone/rclone-web/ GUI

2026-04-10 11:39:50 +01:00

archive

archive extract: fix path traversal letting archives escape the destination CVE-2026-59732

2026-07-08 16:05:38 +01:00

authorize

docs: add link from authorize command docs to remote setup docs

2025-10-02 18:46:16 +02:00

backend

docs: fix markdownlint issues in backend command generated output

2025-11-04 23:00:46 +01:00

bisync

bisync: fix failed transfers of empty files being recorded as synced

2026-09-04 14:07:19 +01:00

cachestats

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cat

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

check

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

checksum

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cleanup

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

cmount

mountlib: rc: fix mounts created with mountPoint "*" overwriting each other

2026-04-27 15:09:14 +01:00

config

config: add config unset command to remove options from a remote - fixes #9541

2026-07-10 18:45:41 +01:00

convmv

build: use "for i := range n", added in go1.22

2025-09-15 12:45:57 +01:00

copy

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

copyto

docs: clarify copyto command description - Fixes #9527

2026-06-29 18:19:49 +01:00

copyurl

copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.

2026-02-17 11:46:37 +00:00

cryptcheck

fix: comment typos

2025-11-13 13:47:40 +00:00

cryptdecode

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

dedupe

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

delete

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

deletefile

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

genautocomplete

completion: fix powershell completion corrupting non-ASCII names - fixes #9412

2026-06-18 13:28:23 +01:00

gendocs

gendocs: refactor and add logging of skipped command docs

2025-09-02 14:06:31 +02:00

gitannex

gitannex: skip e2e tests on macOS CI to avoid timeout

2026-07-30 19:33:42 +01:00

gui

gui: update embedded release to 1.1.11

2026-07-31 12:01:05 +01:00

hashsum

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

link

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

listremotes

listremotes: add --exact flag for filtering - fixes #9076

2026-04-24 16:23:12 +01:00

ls

docs: mention use of ListR feature in ls docs

2025-12-15 09:11:00 +01:00

lsd

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

lsf

lsf: document Google Drive shortcut IDs - fixes #7863

2026-07-24 15:00:09 +01:00

lsjson

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

lsl

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

md5sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

mkdir

docs: group the global flags and make them appear on command and flags pages

2023-08-02 12:53:09 +01:00

mount

vfs: fix crash when multiple mounts or servers share the same VFS

2026-07-27 14:55:20 +01:00

mount2

vfs: fix crash when multiple mounts or servers share the same VFS

2026-07-27 14:55:20 +01:00

mountlib

docs/mount: mention nfsmount for macOS NFS mounts

2026-09-04 14:07:18 +01:00

move

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

moveto

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

ncdu

ncdu/scan: add unit tests for the scan package

2026-06-05 18:13:16 +01:00

nfsmount

nfsmount: call mount_nfs directly on OpenBSD so -T is accepted

2026-07-30 19:54:16 +01:00

obscure

docs: fix echo command syntax for password input

2026-01-18 20:56:26 +01:00

purge

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rc

rc: flip auth default so all endpoints require auth unless opted out

2026-04-19 13:31:27 +01:00

rcat

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

rcd

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

reveal

docs: add minimum versions to the command pages

2022-12-03 18:58:55 +01:00

rmdir

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rmdirs

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

selfupdate

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

serve

serve s3: reject bogus multipart part sizes in the reorder buffer GHSA-2p48-j3qc-rx9f

2026-09-04 16:18:18 +01:00

settier

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

sha1sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

size

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

sync

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

test

test speed: fix formatting of help

2025-11-21 17:02:45 +00:00

touch

touch: add metadata when using --metadata-set

2026-02-26 16:20:24 +00:00

tree

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

version

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

cmd.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

completion.go

cmd: make auto completion work for all shells and reduce the size

2024-02-29 14:46:50 +00:00

help.go

docs: don't show fully hidden backend options in the backend docs

2026-07-29 20:16:22 +01:00

progress.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

selfupdate_disabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

selfupdate_enabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

siginfo_bsd.go

build: update logging statements to make json log work - fixes #6038

2024-09-06 17:04:18 +01:00

siginfo_others.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00