From cadc27b7b5657d9049acbf733ea270c5cbdd62b6 Mon Sep 17 00:00:00 2001
From: Cory McWilliams <cory@unprompted.com>
Date: Thu, 12 Jun 2025 12:50:38 -0400
Subject: [PATCH] ssb: Filter out invalid RPC flags.

---
 apps/ssb/tf-message.js       | 6 ++++--
 apps/ssb/tf-tab-news-feed.js | 6 ++++--
 src/ssb.c                    | 2 +-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/apps/ssb/tf-message.js b/apps/ssb/tf-message.js
index dbee54d6..e50f5aa0 100644
--- a/apps/ssb/tf-message.js
+++ b/apps/ssb/tf-message.js
@@ -632,8 +632,10 @@ class TfMessageElement extends LitElement {
 	}
 
 	allow_unread() {
-		return this.channel == '@' ||
-			(!this.channel.startsWith('@') && !this.channel.startsWith('%'));
+		return (
+			this.channel == '@' ||
+			(!this.channel.startsWith('@') && !this.channel.startsWith('%'))
+		);
 	}
 
 	render_unread_icon() {
diff --git a/apps/ssb/tf-tab-news-feed.js b/apps/ssb/tf-tab-news-feed.js
index 3165b8ee..b4d6ca89 100644
--- a/apps/ssb/tf-tab-news-feed.js
+++ b/apps/ssb/tf-tab-news-feed.js
@@ -276,8 +276,10 @@ class TfTabNewsFeedElement extends LitElement {
 	}
 
 	unread_allowed() {
-		return this.hash == '#@' ||
-			(!this.hash.startsWith('#%') && !this.hash.startsWith('#@'));
+		return (
+			this.hash == '#@' ||
+			(!this.hash.startsWith('#%') && !this.hash.startsWith('#@'))
+		);
 	}
 
 	async load_more() {
diff --git a/src/ssb.c b/src/ssb.c
index 0a013563..254c98b2 100644
--- a/src/ssb.c
+++ b/src/ssb.c
@@ -1839,7 +1839,7 @@ static void _tf_ssb_connection_rpc_recv_push(tf_ssb_connection_t* connection, co
 
 		while (connection->rpc_recv_size >= 9)
 		{
-			uint8_t flags = *connection->rpc_recv_buffer;
+			uint8_t flags = (*connection->rpc_recv_buffer) & 0xf;
 			uint32_t body_len;
 			int32_t request_number;
 			memcpy(&body_len, connection->rpc_recv_buffer + 1, sizeof(body_len));