Forum: War Ensemble BBS

New Defects reported by Coverity Scan for Synchronet

From [email protected]@1:103/705 to [email protected] on Mon Aug 10 13:31:15 2026

----==_mimepart_6a79d2a36a35d_667552b3f398219ac62de
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)

** CID 652885: Integer handling issues (INTEGER_OVERFLOW)
/useredit.cpp: 167 in sbbs_t::useredit(int)()

_____________________________________________________________________________________________
*** CID 652885: Integer handling issues (INTEGER_OVERFLOW) /useredit.cpp: 167 in sbbs_t::useredit(int)()
161 bprintf(text[UeditPrompt], user.number, l);
162 SAFEPRINTF4(str, "QG[]?/{}()%c%c%c%c", TERM_KEY_LEFT, TERM_KEY_RIGHT, TERM_KEY_HOME, TERM_KEY_END);
163 if (user.level <= useron.level)
164 SAFECAT(str, "ABCDEFHIJKLMNOPRSTUVWXYZ+~*$#"); 165 l = getkeys(str, l, K_UPPER | K_NOCRLF);
166 if (l & 0x80000000L) {

CID 652885: Integer handling issues (INTEGER_OVERFLOW)
Expression "user.number", where "l & 0xffffffff7fffffffL" is known to be equal to -2147483649, overflows the type of "user.number", which is type "int".

167 user.number = l & ~0x80000000L;
168 continue;
169 }
170 if (IS_ALPHA(l) || strchr("~+*$/", l) != NULL) // non-alpha commands that prompt
171 term->newline();
172 switch (l) {

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6a79d2a36a35d_667552b3f398219ac62de
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 1</li>
<li>
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 1 of 1 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 652885: Integer handling issues (INTEGER_OVERFLOW)
/useredit.cpp: 167 in sbbs_t::useredit(int)()

_____________________________________________________________________________________________
*** CID 652885: Integer handling issues (INTEGER_OVERFLOW) /useredit.cpp: 167 in sbbs_t::useredit(int)()
161 bprintf(text[UeditPrompt], user.number, l);
162 SAFEPRINTF4(str, "QG[]?/{}()%c%c%c%c", TERM_KEY_LEFT, TERM_KEY_RIGHT, TERM_KEY_HOME, TERM_KEY_END);
163 if (user.level <= useron.level)
164 SAFECAT(str, "ABCDEFHIJKLMNOPRSTUVWXYZ+~*$#");
165 l = getkeys(str, l, K_UPPER | K_NOCRLF);
166 if (l & 0x80000000L) {
>>> CID 652885: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "user.number", where "l & 0xffffffff7fffffffL" is known to be equal to -2147483649, overflows the type of "user.number", which is type "int".
167 user.number = l & ~0x80000000L;
168 continue;
169 }
170 if (IS_ALPHA(l) || strchr("~+*$/", l) != NULL) // non-alpha commands that prompt
171 term->newline();
172 switch (l) {

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6a79d2a36a35d_667552b3f398219ac62de--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From [email protected]@1:103/705 to All on Thu Aug 20 12:49:16 2026

----==_mimepart_6a86f7cb759c0_1065402c19123819ac73024
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)

** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()

_____________________________________________________________________________________________
*** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()
208 lock is a synchronous round-trip that dominates the cost of this scan
209 when the data directory is network-mounted, and no amount of locking
210 makes the result more current than the snapshot it already is. */
211 do {
212 got = 0;
213 while (got < bufsize) {

CID 653403: Insecure data handling (INTEGER_OVERFLOW)
"64000UL - got", which might have underflowed, is passed to "read(file, buf + got, 64000UL - got)".

214 ssize_t rd = read(file, buf + got, bufsize - got);
215 if (rd <= 0)
216 break;
217 got += (size_t)rd;
218 }
219 for (size_t offset = 0; offset + USER_RECORD_LINE_LEN <= got; offset += USER_RECORD_LINE_LEN) {

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6a86f7cb759c0_1065402c19123819ac73024
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 1</li>
<li>
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 1 of 1 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()

_____________________________________________________________________________________________
*** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()
208 lock is a synchronous round-trip that dominates the cost of this scan
209 when the data directory is network-mounted, and no amount of locking
210 makes the result more current than the snapshot it already is. */
211 do {
212 got = 0;
213 while (got < bufsize) {
>>> CID 653403: Insecure data handling (INTEGER_OVERFLOW) >>> "64000UL - got", which might have underflowed, is passed to "read(file, buf + got, 64000UL - got)".
214 ssize_t rd = read(file, buf + got, bufsize - got);
215 if (rd <= 0)
216 break;
217 got += (size_t)rd;
218 }
219 for (size_t offset = 0; offset + USER_RECORD_LINE_LEN <= got; offset += USER_RECORD_LINE_LEN) {

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6a86f7cb759c0_1065402c19123819ac73024--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From [email protected]@1:103/705 to All on Sun Aug 30 12:51:09 2026

----==_mimepart_6a94273d447c5_1a4ee42b3f152419ac2932a
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

3 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)

** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()

_____________________________________________________________________________________________
*** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else
1219 int chmod_result = CHMOD(str, S_IRUSR);
1220 #endif
1221 if (chmod_result != 0) {
1222 errormsg(WHERE, ERR_WRITE, str, errno);

CID 654570: (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.

1223 remove(str);
1224 return false;
1225 }
1226 }
1227
1228 else if (type)
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1207 }
1208 bool write_ok = bbsdev_write(fp, lines, sizeof(lines) / sizeof(lines[0]));
1209 if (fclose(fp) != 0)
1210 write_ok = false;
1211 if (!write_ok) {
1212 errormsg(WHERE, ERR_WRITE, str, 0);

CID 654570: (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.

1213 remove(str);
1214 return false;
1215 }
1216 #if defined(_WIN32)
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else

** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()

_____________________________________________________________________________________________
*** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()
95 || (lengths[at] == 4 && isdigit((unsigned char)parts[at][0])
96 && bbsdev_subtag_chars(parts[at] + 1, 3, isalnum))))
97 at++;
98 while (at < count && lengths[at] == 1
99 && tolower((unsigned char)parts[at][0]) != 'x') {
100 at++;

CID 654569: Memory - illegal accesses (OVERRUN)
Overrunning array "lengths" of 32 8-byte elements at element index 32 (byte offset 263) using index "at" (which evaluates to 32).

101 if (at == count || lengths[at] < 2)
102 return false;
103 while (at < count && lengths[at] >= 2)
104 at++;
105 }
106 if (at < count && lengths[at] == 1 && tolower((unsigned char)parts[at][0]) == 'x')

** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()

_____________________________________________________________________________________________
*** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }

CID 654568: (RESOURCE_LEAK)
Handle variable "fd" going out of scope leaks the handle.

1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }

CID 654568: (RESOURCE_LEAK)
Handle variable "fd" going out of scope leaks the handle.

1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6a94273d447c5_1a4ee42b3f152419ac2932a
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 3</li>
<li>
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 3 of 3 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()

_____________________________________________________________________________________________
*** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else
1219 int chmod_result = CHMOD(str, S_IRUSR);
1220 #endif
1221 if (chmod_result != 0) {
1222 errormsg(WHERE, ERR_WRITE, str, errno); >>> CID 654570: (CHECKED_RETURN)
>>> Calling "remove(str)" without checking return value. This library function may fail and return an error code.
1223 remove(str);
1224 return false;
1225 }
1226 }
1227
1228 else if (type)
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1207 }
1208 bool write_ok = bbsdev_write(fp, lines, sizeof(lines) / sizeof(lines[0]));
1209 if (fclose(fp) != 0)
1210 write_ok = false;
1211 if (!write_ok) {
1212 errormsg(WHERE, ERR_WRITE, str, 0); >>> CID 654570: (CHECKED_RETURN)
>>> Calling "remove(str)" without checking return value. This library function may fail and return an error code.
1213 remove(str);
1214 return false;
1215 }
1216 #if defined(_WIN32)
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else

** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()

_____________________________________________________________________________________________
*** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()
95 || (lengths[at] == 4 && isdigit((unsigned char)parts[at][0])
96 && bbsdev_subtag_chars(parts[at] + 1, 3, isalnum))))
97 at++;
98 while (at < count && lengths[at] == 1
99 && tolower((unsigned char)parts[at][0]) != 'x') { 100 at++;
>>> CID 654569: Memory - illegal accesses (OVERRUN) >>> Overrunning array "lengths" of 32 8-byte elements at element index 32 (byte offset 263) using index "at" (which evaluates to 32).
101 if (at == count || lengths[at] < 2)
102 return false;
103 while (at < count && lengths[at] >= 2) 104 at++;
105 }
106 if (at < count && lengths[at] == 1 && tolower((unsigned char)parts[at][0]) == 'x')

** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()

_____________________________________________________________________________________________
*** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }
>>> CID 654568: (RESOURCE_LEAK)
>>> Handle variable "fd" going out of scope leaks the handle.
1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }
>>> CID 654568: (RESOURCE_LEAK)
>>> Handle variable "fd" going out of scope leaks the handle.
1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6a94273d447c5_1a4ee42b3f152419ac2932a--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From [email protected]@1:103/705 to All on Mon Sep 7 14:25:22 2026

----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

2 new defect(s) introduced to Synchronet found with Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 2 of 2 defect(s)

** CID 655740: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501 in sdl_init()

_____________________________________________________________________________________________
*** CID 655740: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501 in sdl_init()
495 _beginthread(sdl_video_event_thread, 0, NULL);
496 #endif
497 sdl_user_func_ret(SDL_USEREVENT_INIT);
498 sdl_init_mode(ciolib_initial_mode);
499
500 if(sdl_init_good) {

CID 655740: Concurrent data access violations (MISSING_LOCK) >>> Accessing "fullscreen" without holding lock "win_mutex". Elsewhere, "fullscreen" is written to with "win_mutex" held 3 out of 3 times (3 of these accesses strongly imply that it is necessary).

501 cio_api.mode=fullscreen?CIOLIB_MODE_SDL_FULLSCREEN:CIOLIB_MODE_SDL;
502 #ifdef _WIN32
503 FreeConsole();
504 #endif
505 cio_api.options |= CONIO_OPT_PALETTE_SETTING | CONIO_OPT_SET_TITLE | CONIO_OPT_SET_NAME | CONIO_OPT_SET_ICON | CONIO_OPT_EXTERNAL_SCALING | CONIO_OPT_KEY_EVENTS;
506 return(0);

** CID 655739: (ATOMICITY)
/main.cpp: 2782 in output_thread(void *)()
/main.cpp: 2764 in output_thread(void *)()

_____________________________________________________________________________________________
*** CID 655739: (ATOMICITY)
/main.cpp: 2782 in output_thread(void *)()
2776 /* Handle the SSH error here. The lprintf inside GCESSTR
2777 * runs while ssh_mutex is held; releasing+reacquiring it
2778 * across the error report would make the error-handling
2779 * sequence racy (ssh_errors++, online=FALSE) and is the
2780 * wrong tradeoff for a fast log write. */
2781 // coverity[SLEEP:SUPPRESS]

CID 655739: (ATOMICITY)
Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.

2782 GCESSTR(err, node, sbbs->ssh_session, "pushing data");
2783 sbbs->online = false; 2784 sendbytes = buftop - bufbot;
2785 i = sendbytes; // Pretend we sent it all
2786 }
2787 else {
/main.cpp: 2764 in output_thread(void *)()
2758 }
2759 if (sbbs->session_channel == -1) {
2760 i = sendbytes; // Pretend we sent it all
2761 }
2762 else {
2763 if (cryptStatusError((err = cryptSetAttribute(sbbs->ssh_session, CRYPT_SESSINFO_SSH_CHANNEL, sbbs->session_channel)))) {

CID 655739: (ATOMICITY)
Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.

2764 GCESSTR(err, node, sbbs->ssh_session, "setting channel");
2765 sbbs->online = false;
2766 i = sendbytes; // Pretend we sent it all
2767 }
2768 else {
2769 /*

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 2</li>
<li><strong>Defects Shown:</strong> Showing 2 of 2 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 655740: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501 in sdl_init()

_____________________________________________________________________________________________
*** CID 655740: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501 in sdl_init()
495 _beginthread(sdl_video_event_thread, 0, NULL);
496 #endif
497 sdl_user_func_ret(SDL_USEREVENT_INIT);
498 sdl_init_mode(ciolib_initial_mode);
499
500 if(sdl_init_good) {
>>> CID 655740: Concurrent data access violations (MISSING_LOCK)
>>> Accessing "fullscreen" without holding lock "win_mutex". Elsewhere, "fullscreen" is written to with "win_mutex" held 3 out of 3 times (3 of these accesses strongly imply that it is necessary).
501 cio_api.mode=fullscreen?CIOLIB_MODE_SDL_FULLSCREEN:CIOLIB_MODE_SDL;
502 #ifdef _WIN32
503 FreeConsole();
504 #endif
505 cio_api.options |= CONIO_OPT_PALETTE_SETTING | CONIO_OPT_SET_TITLE | CONIO_OPT_SET_NAME | CONIO_OPT_SET_ICON | CONIO_OPT_EXTERNAL_SCALING | CONIO_OPT_KEY_EVENTS;
506 return(0);

** CID 655739: (ATOMICITY)
/main.cpp: 2782 in output_thread(void *)()
/main.cpp: 2764 in output_thread(void *)()

_____________________________________________________________________________________________
*** CID 655739: (ATOMICITY)
/main.cpp: 2782 in output_thread(void *)()
2776 /* Handle the SSH error here. The lprintf inside GCESSTR
2777 * runs while ssh_mutex is held; releasing+reacquiring it
2778 * across the error report would make the error-handling
2779 * sequence racy (ssh_errors++, online=FALSE) and is the
2780 * wrong tradeoff for a fast log write. */
2781 // coverity[SLEEP:SUPPRESS]
>>> CID 655739: (ATOMICITY)
>>> Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.
2782 GCESSTR(err, node, sbbs->ssh_session, "pushing data");
2783 sbbs->online = false;
2784 sendbytes = buftop - bufbot;
2785 i = sendbytes; // Pretend we sent it all
2786 }
2787 else {
/main.cpp: 2764 in output_thread(void *)()
2758 }
2759 if (sbbs->session_channel == -1) {
2760 i = sendbytes; // Pretend we sent it all
2761 }
2762 else {
2763 if (cryptStatusError((err = cryptSetAttribute(sbbs->ssh_session, CRYPT_SESSINFO_SSH_CHANNEL, sbbs->session_channel)))) {
>>> CID 655739: (ATOMICITY)
>>> Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.
2764 GCESSTR(err, node, sbbs->ssh_session, "setting channel");
2765 sbbs->online = false;
2766 i = sendbytes; // Pretend we sent it all
2767 }
2768 else {
2769 /*

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

Sysop:	DaiTengu
Location:	Appleton, WI
Users:	1,136
Nodes:	10 (0 / 10)
Uptime:	09:27:45
Calls:	14,591
Calls today:	2
Files:	186,473
D/L today:	5,421 files (1,615M bytes)
Messages:	2,577,426

New Defects reported by Coverity Scan for Synchronet

Who's Online

Recent Visitors

System Info