https://gitlab.synchro.net/main/sbbs/-/commit/f78c400c0f2a82a127f37cf5
Modified Files:
src/sbbs3/sftp.cpp src/syncterm/sftp_queue.c
Log Message:
sftp consumers: adopt static/borrowed sftp_str_t variants

Replace heap-roundtrip allocations in the SFTP consumers with the new caller-provided struct + static/memstatic helpers. Every site that
was sftp_strdup/memdup'ing a string only to hand it to the library
(which immediately copies it into a tx packet or extension entry)
now wraps the source bytes directly.

sbbs3/sftp.cpp:
- get_lib_attrs / get_dir_attrs / get_filebase_attrs: convert all
six sftp_strdup + sftp_memdup pairs feeding sftp_fattr_add_ext to
sftp_strstatic / sftp_memstatic. Drive-by fix: the heap forms
were leaked in every call (sftp_fattr_add_ext deep-copies its
args, so the caller's strs become orphans the moment the call
returns). Static wrappers eliminate both the allocation and the
leak.
- sftp_open / sftp_opendir handle assembly: replace
sftp_asprintf("%u", ...) and sftp_asprintf("D:%u", ...) with
snprintf into a stack buffer + sftp_memstatic.
- extdesc reply: sftp_strdup(ed) -> sftp_strstatic. ed is a smb
library buffer that's stable through smb_freefilemem.

syncterm/sftp_queue.c:
- per-chunk upload loop: replace sftp_memdup of the read buffer
with sftp_memstatic. This fires once per ~32KB chunk during
file uploads, so the saved alloc/copy/free is the highest-
volume win in the audit.

ssh.c's authorized_keys append site is left as sftp_asprintf for
now — the formatted line is short, the call runs once per session
when sftp_public_key is set, and the string composition genuinely
needs heap storage of unknown length.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---
￭ Synchronet ￭ Vertrauen ￭ Home of Synchronet ￭ [vert/cvs/bbs].synchro.net