From 6a8648fe7362c411201cd60168ad3651a6cd6d62 Mon Sep 17 00:00:00 2001
From: LucasRodriguez <lucasrodriguezbenitez@gmail.com>
Date: Mon, 29 Sep 2025 23:58:25 +0200
Subject: [PATCH 1/2] Fix CI: Add build-essential and update actions to v4

---
 .github/workflows/docker-build.yml | 10 +++++-----
 .github/workflows/ubuntu.yml       |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 0c2a255e..c7cc3a90 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -5,20 +5,20 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: docker/login-action@v1
+      - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/login-action@v1
+      - uses: docker/login-action@v3
         if: 0
         with:
           username: voidic
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
-      - uses: docker/setup-qemu-action@v1
-      - uses: docker/setup-buildx-action@v1
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
       - name: Build the Docker image
         run: docker buildx build -t ghcr.io/${{ github.repository_owner }}/strfry:latest --platform linux/amd64 --platform linux/arm64 --push .
\ No newline at end of file
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 8b6ac21d..b81311e6 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -15,7 +15,7 @@ jobs:
       - name: Build strfry
         run: |
           sudo apt update && sudo apt install -y --no-install-recommends \
-          git g++ make pkg-config libtool ca-certificates \
+          build-essential git g++ make pkg-config libtool ca-certificates \
           libssl-dev zlib1g-dev liblmdb-dev libflatbuffers-dev libsecp256k1-dev libzstd-dev
           git submodule update --init
           make setup-golpe
@@ -34,7 +34,7 @@ jobs:
           echo "filename=$filename" >> $GITHUB_ENV
 
       - name: Upload strfry deb
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ env.filename }}
           path: ${{ env.filename }}

From f3052568316abfd361a7d060d6e15789583771b0 Mon Sep 17 00:00:00 2001
From: William Casarin <jb55@jb55.com>
Date: Tue, 28 Oct 2025 09:46:48 -0700
Subject: [PATCH 2/2] filters: fix potential out-of-bound read

I could not reproduce a crash, but this seems like its possible to
hit, so fix it just in case.

Reported-by: elsat
Signed-off-by: William Casarin <jb55@jb55.com>
---
 src/filters.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/filters.h b/src/filters.h
index 8bcb8e25..c9f4b573 100644
--- a/src/filters.h
+++ b/src/filters.h
@@ -32,7 +32,8 @@ struct FilterSetBytes {
         for (size_t i = 0; i < arr.size(); i++) {
             const auto &item = arr[i];
             if (i > 0 && item == arr[i - 1]) continue; // remove duplicates
-            items.emplace_back(Item{ (uint16_t)buf.size(), (uint8_t)item.size(), (uint8_t)item[0] });
+            uint8_t first = item.empty() ? 0 : (uint8_t)item[0];
+            items.emplace_back(Item{ (uint16_t)buf.size(), (uint8_t)item.size(), first });
             buf += item;
         }