Version 1.2.1 - Bug Fixes

Critical (4)

C1 — udp_client.hpp / udp_client.cpp: Moved mStartReceive() out of the constructor into start(), after the socket is opened.
C2 — client/main.cpp:187: || → && in the main loop condition, so it exits when the connection drops instead of spinning forever.
C3 — tcp_connection.hpp: Added mConnectionAESKey{}, mConnectionSessionID(0), and mConnectionPublicKey{} to the constructor initializer list.
C4 — tcp_server.hpp / tcp_server.cpp: Added std::mutex mClientsMutex and locked it at all three mClients access sites (insert, erase callback, stop snapshot).
High (5)

H1 — tcp_connection.cpp:284: Replaced hardcoded htonl(0x0A0A0001) with htonl(baseIP + 1).
H2 — session_registry.hpp / session_registry.cpp / udp_server.cpp: Changed get() and getByIP() to return shared_ptr<SessionState> (non-const); removed all four const_cast usages.
H3 — session_registry.cpp:90: Guarded against mask == 0 || mask >= 32 (shift UB) and hostCount < 3 (unsigned underflow).
H4 — virtual_interface.cpp: Added runCommandWin32() using CreateProcess (no shell); replaced both system() calls in resetIP().
H5 — virtual_interface.cpp: Added close(mFd); mFd = -1; before both throw sites in the macOS constructor (ioctl failure and connect failure).
Medium (4)

M1 — tcp_connection.cpp:241: Added explicit find() + end-iterator check for NETWORK and SUBNET_MASK before dereferencing.
M2 — tcp_message_handler.cpp: Added an 8 KB (MAX_MSG_BODY = 8192) cap on incoming message body length; oversized messages close the connection.
M3 — tcp_connection.cpp:232: Capped the session ID generation loop at 16 attempts before disconnecting.
M4 — session_registry.cpp:8: put() now evicts the old IP→session mapping before replacing an entry, preventing stale mIPSessions entries.

src/server/net/tcp/tcp_server.cpp

@@ -35,11 +35,15 @@ namespace ColumnLynx::Net::TCP {
                 auto client = TCPConnection::create(
                     std::move(socket),
                     [this](std::shared_ptr<TCPConnection> c) {
+                        std::lock_guard<std::mutex> lock(mClientsMutex);
                         mClients.erase(c);
                         Utils::log("Client removed.");
                     }
                 );
-                mClients.insert(client);
+                {
+                    std::lock_guard<std::mutex> lock(mClientsMutex);
+                    mClients.insert(client);
+                }
                 client->start();
                 Utils::log("Accepted new client connection.");
             
@@ -59,7 +63,11 @@ namespace ColumnLynx::Net::TCP {
         }
 
         // Snapshot to avoid iterator invalidation while callbacks erase()
-        std::vector<std::shared_ptr<TCPConnection>> snapshot(mClients.begin(), mClients.end());
+        std::vector<std::shared_ptr<TCPConnection>> snapshot;
+        {
+            std::lock_guard<std::mutex> lock(mClientsMutex);
+            snapshot.assign(mClients.begin(), mClients.end());
+        }
         for (auto &client : snapshot) {
             try {
                 client->disconnect(); // should shutdown+close the socket