* Add EZXML_MAXEXP limit (8 MB) to ezxml_decode() to prevent exponential memory growth from nested entity definitions (billion laughs attack).
* Add recursion depth limit to ezxml_ent_ok() to prevent CPU exhaustion during DTD processing of deeply nested entity definitions.
* Change _realloc() parameter from unsigned int to size_t to prevent silent truncation of allocation sizes on 64-bit builds.
* Change size calculation variables in ezxml_decode() from long to size_t/ssize_t to prevent signed integer overflow on Windows where long is 32-bit even on x64.
* Add NULL check for strchr() result before pointer arithmetic in entity expansion to prevent undefined behavior on malformed input.
* Add bounds check in ezxml_internal_dtd() entity name parsing to prevent write past buffer.
* Closes Security Advisory report https://github.com/pbatard/rufus/security/advisories/GHSA-55r2-34wg-8mv9.
* User now has to click 3 very explicit agreement checkboxes, in the warning dialog, before they can proceed with the silent option.
* Note that the text of these checkboxes was translated by AI, so we cannot vouch for accuracy.
* Also hide/display the silent option according to the state of the local account/regional/privacy options it depends on, which
should also help reduce the possibility of people proceeding with the silent option by mistake.
* memmove(label, &label[i], len - i) is missing the copy of the NUL terminator due to size being 1 char too small.
* strcpy(s, &s[strlen(remove[i])]) can have overlapped content which is undefined behaviour, so use memmove() instead.
* Closes#2992, with thanks to @christian8641.
* Closes#2984.
* Also Fix "Enable runtime UEFI media validation" checkbox not always being properly enabled
and ensure the README is also updated for VS2026.
* SelectionDialog() was calling GetEditions() unconditionally, which, in the case of an image
with multiple WIMs, produced a new re-entrant call to SelectionDialog() to select the WIM,
thereby producing a new call to GetEditions() and an infinite loop.
* This unconditional call also had the (minor) side effect of calling wim_open() against ISOs
without WIMs, such as Linux ones, resulting in 'Could not open WIM: 43' log errors.
* Fix this by making sure that:
- GetEditions() is only called when needed.
- SelectionDialog() is re-entrant, to at least one level.
* Well, our super-smart way of presenting users with the disk partitioning dialog, so that
they could provide disk drivers instead of seeing their installation drive scratched, was
once again foiled by Windows Setup being an ass when it comes to assigning drive letters.
* First of all, along with S:, U: and X: you don't want to use D: as the drive letter as
it only works if your target drive is "unclean", but, more importantly, the drive letter
assignation process, as designed by Microsoft, ONLY EVER WORKS FOR FIXED DRIVES, and is
not designed to be used with USB drives that are of type REMOVABLE. But of course, since
Microsoft duplicated the drive assignation in 2 steps, one before the file copy and one
after, and they only validate that the drive being mapped is of type FIXED in the latter,
you don't get the error early, where you'd be able to catch it or at least make some sense
of it, but MUCH, MUCH LATER...
* And that is the reason why pretty much everybody who tries the new silent install ends up
with an error at 75% during the file copy phase, since this is when Windows Setup performs
its SECOND remapping of the drive letter and actually tests if the drive is of a type it
can bloody handle! Oh and since our fastest test media are all UAS/SSD-based FIXED drives,
this is what we used during our extensive testing of the silent installation feature, and
the reason why we never saw the issue in the first place.
* Our fix therefore is to drop the letter assignation altogether, since we'll never be able
to use it with the vast majority of consumer USB drive, and instead switch to trying to
relabel the UEFI:NTFS partition, or at least the partition at [disk 1, partition 2] where
it is expected to reside (yeah, don't ask me why Microsoft starts numbering disks at 0
but partitions at 1), since this should be an one-step operation that works regardless of
your drive is of type FIXED or REMOVABLE.
* Testing for the UEFI:NTFS partition should also help us bail out the partition screen on
systems where the user forgot to disconnect all the disks they don't want to see scratched
(since, in most cases these would be data disks without a second partition) thereby helping
prevent unwanted data loss. This should also bail to disk partitioning for people who want
to split WIMs rather than use UEFI:NTFS, but it's their problem. Full silent install is for
UEFI:NTFS only.
* Finally, on some systems that have card readers that Windows Setup happens to map as formal
disks (in my experience, this seems to be the exception rather than the rule), we will also
bail out to the disk partition screen, even if the card reader is empty, but there's really
only so much we can accomplish to address all system scenarios with the limited commands we
have at our disposal during unattended partitioning. Since our priority is to prevent data
loss, as well as show the partition screen whenever it is needed, we consider this annoyance
as a small trade-off, especially as these users should be able to disable card readers from
their UEFI setting. Again, our silent installation process expects that the user will have
disconnected ALL disks except the one they want to install Windows on and that includes card
readers). If that is not the case, all bets are off, and we will try to show the partition
screen, to make the user aware of the deviation.
* Closes#2960.
* Looks like Bitdefender may have changed the label of their hidden VHD, so use a less subtle approach
and filter any VHD under 32 MB that stars with "Bitdefender".
* Closes#2953.
* Well, thinking that OEMs would do the right thing and only use 0/1 as image size *if* the
actual size is more than 0xffff sectors (i.e. 128 MB) was obviously never going to end well
and Lenovo/Nero chose not to bother.
* We therefore reduce the watershed point to 8 MB.
* Also improve logging and avoid reopening an ISO.
