Forum: Mystical Realm BBS

New Defects reported by Coverity Scan for Synchronet

From scan-admin@coverity.com@1:103/705 to All on Thu Aug 20 12:49:16 2026

----==_mimepart_6a86f7cb759c0_1065402c19123819ac73024
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)

** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()

_____________________________________________________________________________________________
*** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()
208 lock is a synchronous round-trip that dominates the cost of this scan
209 when the data directory is network-mounted, and no amount of locking
210 makes the result more current than the snapshot it already is. */
211 do {
212 got = 0;
213 while (got < bufsize) {

CID 653403: Insecure data handling (INTEGER_OVERFLOW)
"64000UL - got", which might have underflowed, is passed to "read(file, buf + got, 64000UL - got)".

214 ssize_t rd = read(file, buf + got, bufsize - got);
215 if (rd <= 0)
216 break;
217 got += (size_t)rd;
218 }
219 for (size_t offset = 0; offset + USER_RECORD_LINE_LEN <= got; offset += USER_RECORD_LINE_LEN) {

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6a86f7cb759c0_1065402c19123819ac73024
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 1</li>
<li>
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 1 of 1 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()

_____________________________________________________________________________________________
*** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()
208 lock is a synchronous round-trip that dominates the cost of this scan
209 when the data directory is network-mounted, and no amount of locking
210 makes the result more current than the snapshot it already is. */
211 do {
212 got = 0;
213 while (got < bufsize) {
>>> CID 653403: Insecure data handling (INTEGER_OVERFLOW) >>> "64000UL - got", which might have underflowed, is passed to "read(file, buf + got, 64000UL - got)".
214 ssize_t rd = read(file, buf + got, bufsize - got);
215 if (rd <= 0)
216 break;
217 got += (size_t)rd;
218 }
219 for (size_t offset = 0; offset + USER_RECORD_LINE_LEN <= got; offset += USER_RECORD_LINE_LEN) {

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6a86f7cb759c0_1065402c19123819ac73024--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From scan-admin@coverity.com@1:103/705 to All on Sun Aug 30 12:51:09 2026

----==_mimepart_6a94273d447c5_1a4ee42b3f152419ac2932a
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

3 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)

** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()

_____________________________________________________________________________________________
*** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else
1219 int chmod_result = CHMOD(str, S_IRUSR);
1220 #endif
1221 if (chmod_result != 0) {
1222 errormsg(WHERE, ERR_WRITE, str, errno);

CID 654570: (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.

1223 remove(str);
1224 return false;
1225 }
1226 }
1227
1228 else if (type)
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1207 }
1208 bool write_ok = bbsdev_write(fp, lines, sizeof(lines) / sizeof(lines[0]));
1209 if (fclose(fp) != 0)
1210 write_ok = false;
1211 if (!write_ok) {
1212 errormsg(WHERE, ERR_WRITE, str, 0);

CID 654570: (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.

1213 remove(str);
1214 return false;
1215 }
1216 #if defined(_WIN32)
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else

** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()

_____________________________________________________________________________________________
*** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()
95 || (lengths[at] == 4 && isdigit((unsigned char)parts[at][0])
96 && bbsdev_subtag_chars(parts[at] + 1, 3, isalnum))))
97 at++;
98 while (at < count && lengths[at] == 1
99 && tolower((unsigned char)parts[at][0]) != 'x') {
100 at++;

CID 654569: Memory - illegal accesses (OVERRUN)
Overrunning array "lengths" of 32 8-byte elements at element index 32 (byte offset 263) using index "at" (which evaluates to 32).

101 if (at == count || lengths[at] < 2)
102 return false;
103 while (at < count && lengths[at] >= 2)
104 at++;
105 }
106 if (at < count && lengths[at] == 1 && tolower((unsigned char)parts[at][0]) == 'x')

** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()

_____________________________________________________________________________________________
*** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }

CID 654568: (RESOURCE_LEAK)
Handle variable "fd" going out of scope leaks the handle.

1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }

CID 654568: (RESOURCE_LEAK)
Handle variable "fd" going out of scope leaks the handle.

1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6a94273d447c5_1a4ee42b3f152419ac2932a
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 3</li>
<li>
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 3 of 3 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()

_____________________________________________________________________________________________
*** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else
1219 int chmod_result = CHMOD(str, S_IRUSR);
1220 #endif
1221 if (chmod_result != 0) {
1222 errormsg(WHERE, ERR_WRITE, str, errno); >>> CID 654570: (CHECKED_RETURN)
>>> Calling "remove(str)" without checking return value. This library function may fail and return an error code.
1223 remove(str);
1224 return false;
1225 }
1226 }
1227
1228 else if (type)
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1207 }
1208 bool write_ok = bbsdev_write(fp, lines, sizeof(lines) / sizeof(lines[0]));
1209 if (fclose(fp) != 0)
1210 write_ok = false;
1211 if (!write_ok) {
1212 errormsg(WHERE, ERR_WRITE, str, 0); >>> CID 654570: (CHECKED_RETURN)
>>> Calling "remove(str)" without checking return value. This library function may fail and return an error code.
1213 remove(str);
1214 return false;
1215 }
1216 #if defined(_WIN32)
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else

** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()

_____________________________________________________________________________________________
*** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()
95 || (lengths[at] == 4 && isdigit((unsigned char)parts[at][0])
96 && bbsdev_subtag_chars(parts[at] + 1, 3, isalnum))))
97 at++;
98 while (at < count && lengths[at] == 1
99 && tolower((unsigned char)parts[at][0]) != 'x') { 100 at++;
>>> CID 654569: Memory - illegal accesses (OVERRUN) >>> Overrunning array "lengths" of 32 8-byte elements at element index 32 (byte offset 263) using index "at" (which evaluates to 32).
101 if (at == count || lengths[at] < 2)
102 return false;
103 while (at < count && lengths[at] >= 2) 104 at++;
105 }
106 if (at < count && lengths[at] == 1 && tolower((unsigned char)parts[at][0]) == 'x')

** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()

_____________________________________________________________________________________________
*** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }
>>> CID 654568: (RESOURCE_LEAK)
>>> Handle variable "fd" going out of scope leaks the handle.
1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }
>>> CID 654568: (RESOURCE_LEAK)
>>> Handle variable "fd" going out of scope leaks the handle.
1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6a94273d447c5_1a4ee42b3f152419ac2932a--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From scan-admin@coverity.com@1:103/705 to All on Mon Sep 7 14:25:22 2026

----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

2 new defect(s) introduced to Synchronet found with Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 2 of 2 defect(s)

** CID 655740: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501 in sdl_init()

_____________________________________________________________________________________________
*** CID 655740: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501 in sdl_init()
495 _beginthread(sdl_video_event_thread, 0, NULL);
496 #endif
497 sdl_user_func_ret(SDL_USEREVENT_INIT);
498 sdl_init_mode(ciolib_initial_mode);
499
500 if(sdl_init_good) {

CID 655740: Concurrent data access violations (MISSING_LOCK) >>> Accessing "fullscreen" without holding lock "win_mutex". Elsewhere, "fullscreen" is written to with "win_mutex" held 3 out of 3 times (3 of these accesses strongly imply that it is necessary).

501 cio_api.mode=fullscreen?CIOLIB_MODE_SDL_FULLSCREEN:CIOLIB_MODE_SDL;
502 #ifdef _WIN32
503 FreeConsole();
504 #endif
505 cio_api.options |= CONIO_OPT_PALETTE_SETTING | CONIO_OPT_SET_TITLE | CONIO_OPT_SET_NAME | CONIO_OPT_SET_ICON | CONIO_OPT_EXTERNAL_SCALING | CONIO_OPT_KEY_EVENTS;
506 return(0);

** CID 655739: (ATOMICITY)
/main.cpp: 2782 in output_thread(void *)()
/main.cpp: 2764 in output_thread(void *)()

_____________________________________________________________________________________________
*** CID 655739: (ATOMICITY)
/main.cpp: 2782 in output_thread(void *)()
2776 /* Handle the SSH error here. The lprintf inside GCESSTR
2777 * runs while ssh_mutex is held; releasing+reacquiring it
2778 * across the error report would make the error-handling
2779 * sequence racy (ssh_errors++, online=FALSE) and is the
2780 * wrong tradeoff for a fast log write. */
2781 // coverity[SLEEP:SUPPRESS]

CID 655739: (ATOMICITY)
Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.

2782 GCESSTR(err, node, sbbs->ssh_session, "pushing data");
2783 sbbs->online = false; 2784 sendbytes = buftop - bufbot;
2785 i = sendbytes; // Pretend we sent it all
2786 }
2787 else {
/main.cpp: 2764 in output_thread(void *)()
2758 }
2759 if (sbbs->session_channel == -1) {
2760 i = sendbytes; // Pretend we sent it all
2761 }
2762 else {
2763 if (cryptStatusError((err = cryptSetAttribute(sbbs->ssh_session, CRYPT_SESSINFO_SSH_CHANNEL, sbbs->session_channel)))) {

CID 655739: (ATOMICITY)
Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.

2764 GCESSTR(err, node, sbbs->ssh_session, "setting channel");
2765 sbbs->online = false;
2766 i = sendbytes; // Pretend we sent it all
2767 }
2768 else {
2769 /*

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 2</li>
<li><strong>Defects Shown:</strong> Showing 2 of 2 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 655740: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501 in sdl_init()

_____________________________________________________________________________________________
*** CID 655740: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501 in sdl_init()
495 _beginthread(sdl_video_event_thread, 0, NULL);
496 #endif
497 sdl_user_func_ret(SDL_USEREVENT_INIT);
498 sdl_init_mode(ciolib_initial_mode);
499
500 if(sdl_init_good) {
>>> CID 655740: Concurrent data access violations (MISSING_LOCK)
>>> Accessing "fullscreen" without holding lock "win_mutex". Elsewhere, "fullscreen" is written to with "win_mutex" held 3 out of 3 times (3 of these accesses strongly imply that it is necessary).
501 cio_api.mode=fullscreen?CIOLIB_MODE_SDL_FULLSCREEN:CIOLIB_MODE_SDL;
502 #ifdef _WIN32
503 FreeConsole();
504 #endif
505 cio_api.options |= CONIO_OPT_PALETTE_SETTING | CONIO_OPT_SET_TITLE | CONIO_OPT_SET_NAME | CONIO_OPT_SET_ICON | CONIO_OPT_EXTERNAL_SCALING | CONIO_OPT_KEY_EVENTS;
506 return(0);

** CID 655739: (ATOMICITY)
/main.cpp: 2782 in output_thread(void *)()
/main.cpp: 2764 in output_thread(void *)()

_____________________________________________________________________________________________
*** CID 655739: (ATOMICITY)
/main.cpp: 2782 in output_thread(void *)()
2776 /* Handle the SSH error here. The lprintf inside GCESSTR
2777 * runs while ssh_mutex is held; releasing+reacquiring it
2778 * across the error report would make the error-handling
2779 * sequence racy (ssh_errors++, online=FALSE) and is the
2780 * wrong tradeoff for a fast log write. */
2781 // coverity[SLEEP:SUPPRESS]
>>> CID 655739: (ATOMICITY)
>>> Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.
2782 GCESSTR(err, node, sbbs->ssh_session, "pushing data");
2783 sbbs->online = false;
2784 sendbytes = buftop - bufbot;
2785 i = sendbytes; // Pretend we sent it all
2786 }
2787 else {
/main.cpp: 2764 in output_thread(void *)()
2758 }
2759 if (sbbs->session_channel == -1) {
2760 i = sendbytes; // Pretend we sent it all
2761 }
2762 else {
2763 if (cryptStatusError((err = cryptSetAttribute(sbbs->ssh_session, CRYPT_SESSINFO_SSH_CHANNEL, sbbs->session_channel)))) {
>>> CID 655739: (ATOMICITY)
>>> Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.
2764 GCESSTR(err, node, sbbs->ssh_session, "setting channel");
2765 sbbs->online = false;
2766 i = sendbytes; // Pretend we sent it all
2767 }
2768 else {
2769 /*

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From scan-admin@coverity.com@1:103/705 to cov-scan@synchro.net on Mon Sep 14 13:45:35 2026

----==_mimepart_6aa7fa7ebcb51_297e652b6718b7799c607a
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)

** CID 656168: High impact quality (Y2K38_SAFETY)
/main.cpp: 4542 in update_client_ini(sbbs_t *, const long *)()

_____________________________________________________________________________________________
*** CID 656168: High impact quality (Y2K38_SAFETY)
/main.cpp: 4542 in update_client_ini(sbbs_t *, const long *)()
4536 iniCloseFile(fp);
4537 return;
4538 }
4539 iniSetUInteger(&ini, ROOT_SECTION, "user", (uint)sbbs->useron.number, NULL);
4540 iniSetString(&ini, ROOT_SECTION, "name", sbbs->useron.alias, NULL);
4541 if (done != NULL)

CID 656168: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "*done" is cast to "uint".

4542 iniSetUInteger(&ini, ROOT_SECTION, "done", (uint)*done, NULL);
4543 iniWriteFile(fp, ini);
4544 iniCloseFile(fp);
4545 iniFreeStringList(ini);
4546 }
4547

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6aa7fa7ebcb51_297e652b6718b7799c607a
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 1</li>
<li>
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 1 of 1 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 656168: High impact quality (Y2K38_SAFETY)
/main.cpp: 4542 in update_client_ini(sbbs_t *, const long *)()

_____________________________________________________________________________________________
*** CID 656168: High impact quality (Y2K38_SAFETY)
/main.cpp: 4542 in update_client_ini(sbbs_t *, const long *)()
4536 iniCloseFile(fp);
4537 return;
4538 }
4539 iniSetUInteger(&ini, ROOT_SECTION, "user", (uint)sbbs->useron.number, NULL);
4540 iniSetString(&ini, ROOT_SECTION, "name", sbbs->useron.alias, NULL);
4541 if (done != NULL)
>>> CID 656168: High impact quality (Y2K38_SAFETY) >>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "*done" is cast to "uint".
4542 iniSetUInteger(&ini, ROOT_SECTION, "done", (uint)*done, NULL);
4543 iniWriteFile(fp, ini);
4544 iniCloseFile(fp);
4545 iniFreeStringList(ini);
4546 }
4547

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6aa7fa7ebcb51_297e652b6718b7799c607a--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From scan-admin@coverity.com@1:103/705 to cov-scan@synchro.net on Fri Sep 25 14:41:33 2026

----==_mimepart_6ab6881d2c31b_354bfd2b6718b7799c6040
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)

** CID 656507: Error handling issues (CHECKED_RETURN) /tmp/sbbs-Sep-24-2026/src/xpdev/genwrap.c: 1530 in xp_pipe_open()

_____________________________________________________________________________________________
*** CID 656507: Error handling issues (CHECKED_RETURN) /tmp/sbbs-Sep-24-2026/src/xpdev/genwrap.c: 1530 in xp_pipe_open() 1524 FILE* fp;
1525
1526 /* A pipe is one-way, so the bidirectional mode gets a socket pair,
1527 which is what the BSD popen() uses for it. */
1528 if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != 0)
1529 return NULL;

CID 656507: Error handling issues (CHECKED_RETURN)
Calling "fcntl(sv[0], 2, 1)" without checking return value. This library function may fail and return an error code.

1530 fcntl(sv[0], F_SETFD, FD_CLOEXEC); /* our end isn't the command's */
1531 if ((pid = fork()) == 0) {
1532 close(sv[0]);
1533 dup2(sv[1], STDIN_FILENO);
1534 dup2(sv[1], STDOUT_FILENO);
1535 if (sv[1] > STDERR_FILENO)

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6ab6881d2c31b_354bfd2b6718b7799c6040
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 1</li>
<li>
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 1 of 1 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 656507: Error handling issues (CHECKED_RETURN) /tmp/sbbs-Sep-24-2026/src/xpdev/genwrap.c: 1530 in xp_pipe_open()

_____________________________________________________________________________________________
*** CID 656507: Error handling issues (CHECKED_RETURN) /tmp/sbbs-Sep-24-2026/src/xpdev/genwrap.c: 1530 in xp_pipe_open() 1524 FILE* fp;
1525
1526 /* A pipe is one-way, so the bidirectional mode gets a socket pair,
1527 which is what the BSD popen() uses for it. */
1528 if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != 0)
1529 return NULL;
>>> CID 656507: Error handling issues (CHECKED_RETURN) >>> Calling "fcntl(sv[0], 2, 1)" without checking return value. This library function may fail and return an error code.
1530 fcntl(sv[0], F_SETFD, FD_CLOEXEC); /* our end isn't the command's */
1531 if ((pid = fork()) == 0) {
1532 close(sv[0]);
1533 dup2(sv[1], STDIN_FILENO);
1534 dup2(sv[1], STDOUT_FILENO);
1535 if (sv[1] > STDERR_FILENO)

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6ab6881d2c31b_354bfd2b6718b7799c6040--

--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From scan-admin@coverity.com@1:103/705 to All on Thu Oct 1 10:10:40 2026

----==_mimepart_6abe319fc4e9d_3b64712c3f1480d994457d6
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

5 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 5 of 5 defect(s)

** CID 656690: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2622 in js_add_cookieval(http_session_t *, const char *, const char *)()

_____________________________________________________________________________________________
*** CID 656690: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2622 in js_add_cookieval(http_session_t *, const char *, const char *)()
2616 errprintf(LOG_ERR, WHERE, "%04d %-5s [%s] failed to create JSString for cookie value '%s', key=%s"
2617 , session->socket, session->client.protocol, session->host_ip, value, key);
2618 else {
2619 lprintf(LOG_DEBUG, "%04d %-5s [%s] Adding cookie value %s=%s at pos %d"
2620 , session->socket, session->client.protocol, session->host_ip, key, value, alen);
2621 val = STRING_TO_JSVAL(js_str);

CID 656690: Error handling issues (CHECKED_RETURN)
Calling "JS_SetElement" without checking return value (as is done elsewhere 32 out of 40 times).

2622 JS_SetElement(session->js_cx, keyarray, alen, &val); 2623 }
2624 }
2625
2626 static void js_add_request_property(http_session_t * session, const char *key, const char *value, size_t len, bool writeable)
2627 {

** CID 656689: Error handling issues (CHECKED_RETURN)
/str.cpp: 1190 in sbbs_t::xfer_prot_menu(XFER_TYPE, user_t *, char *, unsigned long, const char *)()

_____________________________________________________________________________________________
*** CID 656689: Error handling issues (CHECKED_RETURN)
/str.cpp: 1190 in sbbs_t::xfer_prot_menu(XFER_TYPE, user_t *, char *, unsigned long, const char *)()
1184 for (int i = 0; i < cfg.total_prots; i++) {
1185 if (available(i) && count + 1 < size)
1186 keys[count++] = cfg.prot[i]->mnemonic; 1187 }
1188 keys[count] = '\0';
1189 if (extra_keys != nullptr)

CID 656689: Error handling issues (CHECKED_RETURN)
Calling "strlcat" without checking return value (as is done elsewhere 29 out of 31 times).

1190 strlcat(keys, extra_keys, size);
1191 set_cmd_keys(keys);
1192 }
1193 if (type == XFER_DOWNLOAD && current_file != nullptr)
1194 menu("download", P_NOERROR);
1195 bool menu_used = menu(prot_menu_file[type], P_NOERROR);

** CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON)

_____________________________________________________________________________________________
*** CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON) /js_console.cpp: 93 in js_key_str(JSContext *, char)()
87 , CON_PROP_OUTPUT_RATE
88 };
89
90 extern JSClass js_console_class;
91 static JSString* js_key_str(JSContext* cx, char key)
92 {

CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON)
Passing "&key" to function "JS_NewStringCopyN" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.

93 return JS_NewStringCopyN(cx, &key, key == 0 ? 0 : 1);
94 }
95
96 static JSBool js_console_get(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
97 {
98 jsval idval;

** CID 656687: (CHECKED_RETURN)
/qwk.cpp: 456 in sbbs_t::qwk_download()()
/qwk.cpp: 417 in sbbs_t::qwk_download()()

_____________________________________________________________________________________________
*** CID 656687: (CHECKED_RETURN)
/qwk.cpp: 456 in sbbs_t::qwk_download()()
450 }
451 if (!sent) {
452 for (int i = 0; i < cfg.total_subs; i++)
453 subscan[i].ptr = sav_ptr[i];
454 last_ns_time = ns_time;
455 }

CID 656687: (CHECKED_RETURN)
Calling "remove(path)" without checking return value. This library function may fail and return an error code.

456 remove(path);
457 free(sav_ptr);
458 return sent;
459 }
460
461 /****************************************************************************/
/qwk.cpp: 417 in sbbs_t::qwk_download()()
411 return false;
412 }
413 for (int i = 0; i < cfg.total_subs; i++)
414 sav_ptr[i] = subscan[i].ptr;
415 snprintf(path, sizeof path, "%s%s.qwk", cfg.temp_dir, cfg.sys_id);
416 snprintf(fname, sizeof fname, "%s.qwk", cfg.sys_id);

CID 656687: (CHECKED_RETURN)
Calling "remove(path)" without checking return value. This library function may fail and return an error code.

417 remove(path);
418 if (pack_qwk(path, &msgcnt, /* prepack: */ false)) {
419 off_t l = flength(path);
420 bprintf(text[FiFilename], getfname(path));
421 bprintf(text[FiFileSize], u64toac(l, tmp)
422 , byte_estimate_to_str(l, tmp2, sizeof(tmp2), /* units: */ 1024, /* precision: */ 1));

** CID 656686: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2584 in js_add_queryval(http_session_t *, const char *, const char *)()

_____________________________________________________________________________________________
*** CID 656686: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2584 in js_add_queryval(http_session_t *, const char *, const char *)()
2578 errprintf(LOG_ERR, WHERE, "%04d %-5s [%s] failed to create JSString for query value '%s', key=%s"
2579 , session->socket, session->client.protocol, session->host_ip, value, key);
2580 else {
2581 lprintf(LOG_DEBUG, "%04d %-5s [%s] Adding query value %s=%s at pos %d"
2582 , session->socket, session->client.protocol, session->host_ip, key, value, alen);
2583 val = STRING_TO_JSVAL(js_str);

CID 656686: Error handling issues (CHECKED_RETURN)
Calling "JS_SetElement" without checking return value (as is done elsewhere 32 out of 40 times).

2584 JS_SetElement(session->js_cx, keyarray, alen, &val); 2585 }
2586 }
2587
2588 static void js_add_cookieval(http_session_t * session, const char *key, const char *value)
2589 {

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6abe319fc4e9d_3b64712c3f1480d994457d6
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 5</li>
<li>
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 5 of 5 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 656690: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2622 in js_add_cookieval(http_session_t *, const char *, const char *)()

_____________________________________________________________________________________________
*** CID 656690: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2622 in js_add_cookieval(http_session_t *, const char *, const char *)()
2616 errprintf(LOG_ERR, WHERE, "%04d %-5s [%s] failed to create JSString for cookie value '%s', key=%s"
2617 , session->socket, session->client.protocol, session->host_ip, value, key);
2618 else {
2619 lprintf(LOG_DEBUG, "%04d %-5s [%s] Adding cookie value %s=%s at pos %d"
2620 , session->socket, session->client.protocol, session->host_ip, key, value, alen);
2621 val = STRING_TO_JSVAL(js_str);
>>> CID 656690: Error handling issues (CHECKED_RETURN) >>> Calling "JS_SetElement" without checking return value (as is done elsewhere 32 out of 40 times).
2622 JS_SetElement(session->js_cx, keyarray, alen, &val);
2623 }
2624 }
2625
2626 static void js_add_request_property(http_session_t * session, const char *key, const char *value, size_t len, bool writeable)
2627 {

** CID 656689: Error handling issues (CHECKED_RETURN)
/str.cpp: 1190 in sbbs_t::xfer_prot_menu(XFER_TYPE, user_t *, char *, unsigned long, const char *)()

_____________________________________________________________________________________________
*** CID 656689: Error handling issues (CHECKED_RETURN)
/str.cpp: 1190 in sbbs_t::xfer_prot_menu(XFER_TYPE, user_t *, char *, unsigned long, const char *)()
1184 for (int i = 0; i < cfg.total_prots; i++) {
1185 if (available(i) && count + 1 < size)
1186 keys[count++] = cfg.prot[i]->mnemonic;
1187 }
1188 keys[count] = '\0';
1189 if (extra_keys != nullptr)
>>> CID 656689: Error handling issues (CHECKED_RETURN) >>> Calling "strlcat" without checking return value (as is done elsewhere 29 out of 31 times).
1190 strlcat(keys, extra_keys, size);
1191 set_cmd_keys(keys);
1192 }
1193 if (type == XFER_DOWNLOAD && current_file != nullptr) 1194 menu("download", P_NOERROR);
1195 bool menu_used = menu(prot_menu_file[type], P_NOERROR);

** CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON)

_____________________________________________________________________________________________
*** CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON) /js_console.cpp: 93 in js_key_str(JSContext *, char)()
87 , CON_PROP_OUTPUT_RATE
88 };
89
90 extern JSClass js_console_class;
91 static JSString* js_key_str(JSContext* cx, char key)
92 {
>>> CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON) >>> Passing "&key" to function "JS_NewStringCopyN" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.
93 return JS_NewStringCopyN(cx, &key, key == 0 ? 0 : 1);
94 }
95
96 static JSBool js_console_get(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
97 {
98 jsval idval;

** CID 656687: (CHECKED_RETURN)
/qwk.cpp: 456 in sbbs_t::qwk_download()()
/qwk.cpp: 417 in sbbs_t::qwk_download()()

_____________________________________________________________________________________________
*** CID 656687: (CHECKED_RETURN)
/qwk.cpp: 456 in sbbs_t::qwk_download()()
450 }
451 if (!sent) {
452 for (int i = 0; i < cfg.total_subs; i++)
453 subscan[i].ptr = sav_ptr[i];
454 last_ns_time = ns_time;
455 }
>>> CID 656687: (CHECKED_RETURN)
>>> Calling "remove(path)" without checking return value. This library function may fail and return an error code.
456 remove(path);
457 free(sav_ptr);
458 return sent;
459 }
460
461 /****************************************************************************/
/qwk.cpp: 417 in sbbs_t::qwk_download()()
411 return false;
412 }
413 for (int i = 0; i < cfg.total_subs; i++)
414 sav_ptr[i] = subscan[i].ptr;
415 snprintf(path, sizeof path, "%s%s.qwk", cfg.temp_dir, cfg.sys_id);
416 snprintf(fname, sizeof fname, "%s.qwk", cfg.sys_id); >>> CID 656687: (CHECKED_RETURN)
>>> Calling "remove(path)" without checking return value. This library function may fail and return an error code.
417 remove(path);
418 if (pack_qwk(path, &msgcnt, /* prepack: */ false)) {
419 off_t l = flength(path);
420 bprintf(text[FiFilename], getfname(path));
421 bprintf(text[FiFileSize], u64toac(l, tmp)
422 , byte_estimate_to_str(l, tmp2, sizeof(tmp2), /* units: */ 1024, /* precision: */ 1));

** CID 656686: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2584 in js_add_queryval(http_session_t *, const char *, const char *)()

_____________________________________________________________________________________________
*** CID 656686: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2584 in js_add_queryval(http_session_t *, const char *, const char *)()
2578 errprintf(LOG_ERR, WHERE, "%04d %-5s [%s] failed to create JSString for query value '%s', key=%s"
2579 , session->socket, session->client.protocol, session->host_ip, value, key);
2580 else {
2581 lprintf(LOG_DEBUG, "%04d %-5s [%s] Adding query value %s=%s at pos %d"
2582 , session->socket, session->client.protocol, session->host_ip, key, value, alen);
2583 val = STRING_TO_JSVAL(js_str);
>>> CID 656686: Error handling issues (CHECKED_RETURN) >>> Calling "JS_SetElement" without checking return value (as is done elsewhere 32 out of 40 times).
2584 JS_SetElement(session->js_cx, keyarray, alen, &val);
2585 }
2586 }
2587
2588 static void js_add_cookieval(http_session_t * session, const char *key, const char *value)
2589 {

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6abe319fc4e9d_3b64712c3f1480d994457d6--

--- SBBSecho 3.38-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From scan-admin@coverity.com@1:103/705 to All on Mon Oct 26 12:49:36 2026

----==_mimepart_6adf4c5fd5c7a_121aef2b1c6f8d19ac1572d
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

5 new defect(s) introduced to Synchronet found with Coverity Scan.
3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 5 of 5 defect(s)

** CID 661079: Error handling issues (CHECKED_RETURN)
/pack_rep.cpp: 114 in sbbs_t::pack_rep(unsigned int, unsigned int *)()

_____________________________________________________________________________________________
*** CID 661079: Error handling issues (CHECKED_RETURN)
/pack_rep.cpp: 114 in sbbs_t::pack_rep(unsigned int, unsigned int *)()
108 fexistcase(str);
109 if ((hdrs = fopen(str, "a")) == NULL)
110 errormsg(WHERE, ERR_CREATE, str, 0);
111 }
112 if (!(cfg.qhub[hubnum]->misc & QHUB_NOVOTING)) {
113 SAFEPRINTF(str, "%sVOTING.DAT", cfg.temp_dir);

CID 661079: Error handling issues (CHECKED_RETURN)
Calling "fexistcase" without checking return value (as is done elsewhere 126 out of 136 times).

114 fexistcase(str);
115 if ((voting = fopen(str, "a")) == NULL)
116 errormsg(WHERE, ERR_CREATE, str, 0);
117 }
118 /*********************/
119 /* Pack new messages */

** CID 661078: (Y2K38_SAFETY)
/pack_qwk.cpp: 628 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
/pack_qwk.cpp: 146 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
/pack_qwk.cpp: 623 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()

_____________________________________________________________________________________________
*** CID 661078: (Y2K38_SAFETY)
/pack_qwk.cpp: 628 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
622 , tmp
623 , (uint)elapsed
624 , (uint64_t)((*msgcnt) + mailmsgs) / elapsed);
625 lprintf(LOG_INFO, "packed %u messages (%s bytes) in %u seconds (%u msgs/sec)"
626 , (*msgcnt) + mailmsgs
627 , tmp

CID 661078: (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "elapsed" is cast to "uint".

628 , (uint)elapsed
629 , (uint)(((*msgcnt) + mailmsgs) / elapsed)); 630 }
631
632 BOOL voting_data = FALSE;
633 if (!fclose_checked(qwk)) {
/pack_qwk.cpp: 146 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
140 return false;
141 }
142
143 now = time(NULL);
144 if (localtime_r(&now, &tm) == NULL) {
145 fclose(stream);

CID 661078: (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "this->now" is cast to "uint".

146 errormsg(WHERE, ERR_CHK, "time", (uint)now); 147 return false;
148 }
149
150 fprintf(stream, "%s\r\n%s\r\n%s\r\n%s, Sysop\r\n0000,%s\r\n"
151 "%02u-%02u-%u,%02u:%02u:%02u\r\n" /pack_qwk.cpp: 623 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
617 byte_estimate_to_str(ftell(qwk), tmp, sizeof(tmp), 1024, 1);
618 if (online == ON_REMOTE)
619 bprintf("\r\n\r\n\1n\1hPacked %u messages (%s bytes) in %u seconds "
620 "(%" PRIu64 " messages/second)."
621 , (*msgcnt) + mailmsgs
622 , tmp

CID 661078: (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "elapsed" is cast to "uint".

623 , (uint)elapsed
624 , (uint64_t)((*msgcnt) + mailmsgs) / elapsed);
625 lprintf(LOG_INFO, "packed %u messages (%s bytes) in %u seconds (%u msgs/sec)"
626 , (*msgcnt) + mailmsgs
627 , tmp
628 , (uint)elapsed

** CID 661077: Security best practices violations (TOCTOU)
/nopen.c: 217 in fmutex_close()

_____________________________________________________________________________________________
*** CID 661077: Security best practices violations (TOCTOU)
/nopen.c: 217 in fmutex_close()
211 #if !defined _WIN32 // should only be necessary (and possible) on *nix 212 // Remove before close, and only the file we opened: once our lock aged out and
213 // was taken over, the file by this name is the new holder's 214 if (fstat(fm->fd, &fd_st) != 0) {
215 error = errno;
216 result = false;

CID 661077: Security best practices violations (TOCTOU)
Calling function "stat" to perform check on "fm->name".

217 } else if (stat(fm->name, &name_st) != 0) {
218 if (errno != ENOENT) {
219 error = errno;
220 result = false;
221 }
222 } else if (fd_st.st_dev == name_st.st_dev && fd_st.st_ino == name_st.st_ino) {

** CID 661076: (CHECKED_RETURN)
/qwkjob.cpp: 412 in qwkjob_pack_locked(sbbs_t *, const qwkjob_host *, unsigned int, unsigned int *, char *, unsigned long)()
/qwkjob.cpp: 397 in qwkjob_pack_locked(sbbs_t *, const qwkjob_host *, unsigned int, unsigned int *, char *, unsigned long)()

_____________________________________________________________________________________________
*** CID 661076: (CHECKED_RETURN)
/qwkjob.cpp: 412 in qwkjob_pack_locked(sbbs_t *, const qwkjob_host *, unsigned int, unsigned int *, char *, unsigned long)()
406 if (!qwkjob_replace_file(tmppath, qwkpath)) {
407 #ifdef _WIN32
408 sbbs->lprintf(LOG_ERR, "!ERROR (WinError %u) renaming %s to %s", (uint)GetLastError(), tmppath, qwkpath);
409 #else
410 sbbs->lprintf(LOG_ERR, "!ERROR %d (%s) renaming %s to %s", errno, strerror(errno), tmppath, qwkpath);
411 #endif

CID 661076: (CHECKED_RETURN)
Calling "remove(tmppath)" without checking return value. This library function may fail and return an error code.

412 remove(tmppath);
413 return QWKJOB_FAILED;
414 }
415 sbbs->lprintf(LOG_INFO, "Packing completed: %s", qwkpath);
416 sbbs->qwk_success(count, 0, /* prepack: */ 1);
417 sbbs->putmsgptrs();
/qwkjob.cpp: 397 in qwkjob_pack_locked(sbbs_t *, const qwkjob_host *, unsigned int, unsigned int *, char *, unsigned long)()
391 if (qwkjob_terminated(host))
392 return QWKJOB_FAILED;
393 sbbs->lprintf(LOG_INFO, "Packing QWK Message Packet");
394 SAFEPRINTF4(tmppath, "%sfile/%04u.%s.%d.qwk.tmp", sbbs->cfg.data_dir, usernum, qwkjob_local_host_name(), (int)getpid());
395 SAFEPRINTF2(qwkpath, "%sfile/%04u.qwk", sbbs->cfg.data_dir, usernum);
396 if (!sbbs->pack_qwk(tmppath, &count, /* prepack: */ true, &reason)) {

CID 661076: (CHECKED_RETURN)
Calling "remove(tmppath)" without checking return value. This library function may fail and return an error code.

397 remove(tmppath);
398 if (reason == QWKJOB_EMPTY)
399 sbbs->lputs(LOG_INFO, "No packet created (no new messages)");
400 return reason;
401 }
402 if (qwkjob_terminated(host)) {

** CID 661075: Incorrect expression (EVALUATION_ORDER)
/pack_qwk.cpp: 798 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()

_____________________________________________________________________________________________
*** CID 661075: Incorrect expression (EVALUATION_ORDER)
/pack_qwk.cpp: 798 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
792 lprintf(LOG_ERR, "libarchive error (%s) creating %s", error, packet);
793 else
794 lprintf(LOG_INFO, "libarchive created %s from %d files", packet, file_count);
795 }
796 if (flength(packet) < 1) {
797 remove(packet);

CID 661075: Incorrect expression (EVALUATION_ORDER)
In argument #1 of "this->cmdstr(this->temp_cmd(ex), packet, path, NULL, ex)", a call is made to "this->temp_cmd(ex)". In argument #1 of this function, the object "ex" is modified. This object is also used in "ex", the argument #5 of the outer function call. The order in which these arguments are evaluated is not specified, and will vary between platforms.

798 cmdstr(temp_cmd(ex), packet, path, NULL, ex);
799 if ((i = external(cmdstr_output, ex | EX_WILDCARD)) != 0)
800 errormsg(WHERE, ERR_EXEC, cmdstr_output, i); 801 if (flength(packet) < 1) {
802 bputs(text[QWKCompressionFailed]);
803 return false;

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6adf4c5fd5c7a_121aef2b1c6f8d19ac1572d
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 5</li>
<li>
3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 5 of 5 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 661079: Error handling issues (CHECKED_RETURN)
/pack_rep.cpp: 114 in sbbs_t::pack_rep(unsigned int, unsigned int *)()

_____________________________________________________________________________________________
*** CID 661079: Error handling issues (CHECKED_RETURN)
/pack_rep.cpp: 114 in sbbs_t::pack_rep(unsigned int, unsigned int *)()
108 fexistcase(str);
109 if ((hdrs = fopen(str, "a")) == NULL)
110 errormsg(WHERE, ERR_CREATE, str, 0);
111 }
112 if (!(cfg.qhub[hubnum]->misc & QHUB_NOVOTING)) {
113 SAFEPRINTF(str, "%sVOTING.DAT", cfg.temp_dir);
>>> CID 661079: Error handling issues (CHECKED_RETURN) >>> Calling "fexistcase" without checking return value (as is done elsewhere 126 out of 136 times).
114 fexistcase(str);
115 if ((voting = fopen(str, "a")) == NULL)
116 errormsg(WHERE, ERR_CREATE, str, 0);
117 }
118 /*********************/
119 /* Pack new messages */

** CID 661078: (Y2K38_SAFETY)
/pack_qwk.cpp: 628 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
/pack_qwk.cpp: 146 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
/pack_qwk.cpp: 623 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()

_____________________________________________________________________________________________
*** CID 661078: (Y2K38_SAFETY)
/pack_qwk.cpp: 628 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
622 , tmp
623 , (uint)elapsed
624 , (uint64_t)((*msgcnt) + mailmsgs) / elapsed);
625 lprintf(LOG_INFO, "packed %u messages (%s bytes) in %u seconds (%u msgs/sec)"
626 , (*msgcnt) + mailmsgs
627 , tmp
>>> CID 661078: (Y2K38_SAFETY)
>>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "elapsed" is cast to "uint".
628 , (uint)elapsed
629 , (uint)(((*msgcnt) + mailmsgs) / elapsed)); 630 }
631
632 BOOL voting_data = FALSE;
633 if (!fclose_checked(qwk)) {
/pack_qwk.cpp: 146 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
140 return false;
141 }
142
143 now = time(NULL);
144 if (localtime_r(&now, &tm) == NULL) {
145 fclose(stream);
>>> CID 661078: (Y2K38_SAFETY)
>>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "this->now" is cast to "uint".
146 errormsg(WHERE, ERR_CHK, "time", (uint)now);
147 return false;
148 }
149
150 fprintf(stream, "%s\r\n%s\r\n%s\r\n%s, Sysop\r\n0000,%s\r\n"
151 "%02u-%02u-%u,%02u:%02u:%02u\r\n" /pack_qwk.cpp: 623 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
617 byte_estimate_to_str(ftell(qwk), tmp, sizeof(tmp), 1024, 1);
618 if (online == ON_REMOTE)
619 bprintf("\r\n\r\n\1n\1hPacked %u messages (%s bytes) in %u seconds "
620 "(%" PRIu64 " messages/second)."
621 , (*msgcnt) + mailmsgs
622 , tmp
>>> CID 661078: (Y2K38_SAFETY)
>>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "elapsed" is cast to "uint".
623 , (uint)elapsed
624 , (uint64_t)((*msgcnt) + mailmsgs) / elapsed);
625 lprintf(LOG_INFO, "packed %u messages (%s bytes) in %u seconds (%u msgs/sec)"
626 , (*msgcnt) + mailmsgs
627 , tmp
628 , (uint)elapsed

** CID 661077: Security best practices violations (TOCTOU)
/nopen.c: 217 in fmutex_close()

_____________________________________________________________________________________________
*** CID 661077: Security best practices violations (TOCTOU)
/nopen.c: 217 in fmutex_close()
211 #if !defined _WIN32 // should only be necessary (and possible) on *nix 212 // Remove before close, and only the file we opened: once our lock aged out and
213 // was taken over, the file by this name is the new holder's
214 if (fstat(fm->fd, &fd_st) != 0) {
215 error = errno;
216 result = false;
>>> CID 661077: Security best practices violations (TOCTOU)
>>> Calling function "stat" to perform check on "fm->name".
217 } else if (stat(fm->name, &name_st) != 0) {
218 if (errno != ENOENT) {
219 error = errno;
220 result = false;
221 }
222 } else if (fd_st.st_dev == name_st.st_dev && fd_st.st_ino == name_st.st_ino) {

** CID 661076: (CHECKED_RETURN)
/qwkjob.cpp: 412 in qwkjob_pack_locked(sbbs_t *, const qwkjob_host *, unsigned int, unsigned int *, char *, unsigned long)()
/qwkjob.cpp: 397 in qwkjob_pack_locked(sbbs_t *, const qwkjob_host *, unsigned int, unsigned int *, char *, unsigned long)()

_____________________________________________________________________________________________
*** CID 661076: (CHECKED_RETURN)
/qwkjob.cpp: 412 in qwkjob_pack_locked(sbbs_t *, const qwkjob_host *, unsigned int, unsigned int *, char *, unsigned long)()
406 if (!qwkjob_replace_file(tmppath, qwkpath)) {
407 #ifdef _WIN32
408 sbbs->lprintf(LOG_ERR, "!ERROR (WinError %u) renaming %s to %s", (uint)GetLastError(), tmppath, qwkpath);
409 #else
410 sbbs->lprintf(LOG_ERR, "!ERROR %d (%s) renaming %s to %s", errno, strerror(errno), tmppath, qwkpath);
411 #endif
>>> CID 661076: (CHECKED_RETURN)
>>> Calling "remove(tmppath)" without checking return value. This library function may fail and return an error code.
412 remove(tmppath);
413 return QWKJOB_FAILED;
414 }
415 sbbs->lprintf(LOG_INFO, "Packing completed: %s", qwkpath);
416 sbbs->qwk_success(count, 0, /* prepack: */ 1);
417 sbbs->putmsgptrs();
/qwkjob.cpp: 397 in qwkjob_pack_locked(sbbs_t *, const qwkjob_host *, unsigned int, unsigned int *, char *, unsigned long)()
391 if (qwkjob_terminated(host))
392 return QWKJOB_FAILED;
393 sbbs->lprintf(LOG_INFO, "Packing QWK Message Packet");
394 SAFEPRINTF4(tmppath, "%sfile/%04u.%s.%d.qwk.tmp", sbbs->cfg.data_dir, usernum, qwkjob_local_host_name(), (int)getpid());
395 SAFEPRINTF2(qwkpath, "%sfile/%04u.qwk", sbbs->cfg.data_dir, usernum);
396 if (!sbbs->pack_qwk(tmppath, &count, /* prepack: */ true, &reason)) {
>>> CID 661076: (CHECKED_RETURN)
>>> Calling "remove(tmppath)" without checking return value. This library function may fail and return an error code.
397 remove(tmppath);
398 if (reason == QWKJOB_EMPTY)
399 sbbs->lputs(LOG_INFO, "No packet created (no new messages)");
400 return reason;
401 }
402 if (qwkjob_terminated(host)) {

** CID 661075: Incorrect expression (EVALUATION_ORDER)
/pack_qwk.cpp: 798 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()

_____________________________________________________________________________________________
*** CID 661075: Incorrect expression (EVALUATION_ORDER)
/pack_qwk.cpp: 798 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
792 lprintf(LOG_ERR, "libarchive error (%s) creating %s", error, packet);
793 else
794 lprintf(LOG_INFO, "libarchive created %s from %d files", packet, file_count);
795 }
796 if (flength(packet) < 1) {
797 remove(packet);
>>> CID 661075: Incorrect expression (EVALUATION_ORDER) >>> In argument #1 of "this->cmdstr(this->temp_cmd(ex), packet, path, NULL, ex)", a call is made to "this->temp_cmd(ex)". In argument #1 of this function, the object "ex" is modified. This object is also used in "ex", the argument #5 of the outer function call. The order in which these arguments are evaluated is not specified, and will vary between platforms.
798 cmdstr(temp_cmd(ex), packet, path, NULL, ex);
799 if ((i = external(cmdstr_output, ex | EX_WILDCARD)) != 0)
800 errormsg(WHERE, ERR_EXEC, cmdstr_output, i); 801 if (flength(packet) < 1) {
802 bputs(text[QWKCompressionFailed]);
803 return false;

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6adf4c5fd5c7a_121aef2b1c6f8d19ac1572d--

--- SBBSecho 3.38-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

From scan-admin@coverity.com@1:103/705 to cov-scan@synchro.net on Tue Oct 27 12:48:12 2026

----==_mimepart_6ae09d8b8e3c9_131d0a2b1c6f8d19ac1571a
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

2 new defect(s) introduced to Synchronet found with Coverity Scan.
4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 2 of 2 defect(s)

** CID 661198: Error handling issues (CHECKED_RETURN)
/pack_qwk.cpp: 660 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()

_____________________________________________________________________________________________
*** CID 661198: Error handling issues (CHECKED_RETURN)
/pack_qwk.cpp: 660 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
654 SAFEPRINTF(str, "%sPERSONAL.NDX", cfg.temp_dir);
655 if (!fclose_checked(personal)) {
656 errormsg(WHERE, ERR_WRITE, str, 0);
657 write_error = true;
658 }
659 if (!flength(str))

CID 661198: Error handling issues (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.

660 remove(str);
661 }
662 term->newline();
663
664 // #1244
665 SAFEPRINTF(str, "%sMESSAGES.DAT", cfg.temp_dir);

** CID 661197: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 1982 in finduserstr()

_____________________________________________________________________________________________
*** CID 661197: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 1982 in finduserstr()
1976 overlapping a record another process holds locked fails; any record
1977 not read in bulk is then read singly, taking the lock. */
1978 size_t want = (size_t)count * USER_RECORD_LINE_LEN; 1979 size_t got = 0;
1980 if (seekuserdat(file, unum)) {
1981 while (got < want) {

CID 661197: Insecure data handling (INTEGER_OVERFLOW)
"want - got", which might have underflowed, is passed to "read(file, buf + got, want - got)".

1982 ssize_t rd = read(file, buf + got, want - got);
1983 if (rd <= 0)
1984 break;
1985 got += (size_t)rd;
1986 }
1987 }

________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview

----==_mimepart_6ae09d8b8e3c9_131d0a2b1c6f8d19ac1571a
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - Synchronet</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>

<p>
Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
found with Coverity Scan.
</p>

<ul>
<li><strong>New Defects Found:</strong> 2</li>
<li>
4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 2 of 2 defect(s)</li>
</ul>

<h3>Defect Details</h3>
<pre>
** CID 661198: Error handling issues (CHECKED_RETURN)
/pack_qwk.cpp: 660 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()

_____________________________________________________________________________________________
*** CID 661198: Error handling issues (CHECKED_RETURN)
/pack_qwk.cpp: 660 in sbbs_t::pack_qwk(char *, unsigned int *, bool, qwkjob_result *)()
654 SAFEPRINTF(str, "%sPERSONAL.NDX", cfg.temp_dir);
655 if (!fclose_checked(personal)) {
656 errormsg(WHERE, ERR_WRITE, str, 0);
657 write_error = true;
658 }
659 if (!flength(str))
>>> CID 661198: Error handling issues (CHECKED_RETURN) >>> Calling "remove(str)" without checking return value. This library function may fail and return an error code.
660 remove(str);
661 }
662 term->newline();
663
664 // #1244
665 SAFEPRINTF(str, "%sMESSAGES.DAT", cfg.temp_dir);

** CID 661197: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 1982 in finduserstr()

_____________________________________________________________________________________________
*** CID 661197: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 1982 in finduserstr()
1976 overlapping a record another process holds locked fails; any record
1977 not read in bulk is then read singly, taking the lock. */
1978 size_t want = (size_t)count * USER_RECORD_LINE_LEN; 1979 size_t got = 0;
1980 if (seekuserdat(file, unum)) {
1981 while (got < want) {
>>> CID 661197: Insecure data handling (INTEGER_OVERFLOW) >>> "want - got", which might have underflowed, is passed to "read(file, buf + got, want - got)".
1982 ssize_t rd = read(file, buf + got, want - got);
1983 if (rd <= 0)
1984 break;
1985 got += (size_t)rd;
1986 }
1987 }

</pre>

<p>
<a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>

<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6ae09d8b8e3c9_131d0a2b1c6f8d19ac1571a--

--- SBBSecho 3.38-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

Sysop:	Darkmage
Location:	Tucson, Arizona
Users:	5
Nodes:	4 (0 / 4)
Uptime:	498106:06:02
Calls:	65
Files:	2
Messages:	44,716

New Defects reported by Coverity Scan for Synchronet

Who's Online

Recent Visitors

System Info