Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)


** CID 652885: Integer handling issues (INTEGER_OVERFLOW)
/useredit.cpp: 167 in sbbs_t::useredit(int)()


_____________________________________________________________________________________________
*** CID 652885: Integer handling issues (INTEGER_OVERFLOW) /useredit.cpp: 167 in sbbs_t::useredit(int)()
161 bprintf(text[UeditPrompt], user.number, l);
162 SAFEPRINTF4(str, "QG[]?/{}()%c%c%c%c", TERM_KEY_LEFT, TERM_KEY_RIGHT, TERM_KEY_HOME, TERM_KEY_END);
163 if (user.level <= useron.level)
164 SAFECAT(str, "ABCDEFHIJKLMNOPRSTUVWXYZ+~*$#"); 165 l = getkeys(str, l, K_UPPER | K_NOCRLF);
166 if (l & 0x80000000L) {

CID 652885: Integer handling issues (INTEGER_OVERFLOW)
Expression "user.number", where "l & 0xffffffff7fffffffL" is known to be equal to -2147483649, overflows the type of "user.number", which is type "int".

167 user.number = l & ~0x80000000L;
168 continue;
169 }
170 if (IS_ALPHA(l) || strchr("~+*$/", l) != NULL) // non-alpha commands that prompt
171 term->newline();
172 switch (l) {


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview



---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)


** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()


_____________________________________________________________________________________________
*** CID 653403: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 214 in total_users()
208 lock is a synchronous round-trip that dominates the cost of this scan
209 when the data directory is network-mounted, and no amount of locking
210 makes the result more current than the snapshot it already is. */
211 do {
212 got = 0;
213 while (got < bufsize) {

CID 653403: Insecure data handling (INTEGER_OVERFLOW)
"64000UL - got", which might have underflowed, is passed to "read(file, buf + got, 64000UL - got)".

214 ssize_t rd = read(file, buf + got, bufsize - got);
215 if (rd <= 0)
216 break;
217 got += (size_t)rd;
218 }
219 for (size_t offset = 0; offset + USER_RECORD_LINE_LEN <= got; offset += USER_RECORD_LINE_LEN) {


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview



---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

3 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)


** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()


_____________________________________________________________________________________________
*** CID 654570: (CHECKED_RETURN)
/xtrn_sec.cpp: 1223 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else
1219 int chmod_result = CHMOD(str, S_IRUSR);
1220 #endif
1221 if (chmod_result != 0) {
1222 errormsg(WHERE, ERR_WRITE, str, errno);

CID 654570: (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.

1223 remove(str);
1224 return false;
1225 }
1226 }
1227
1228 else if (type)
/xtrn_sec.cpp: 1213 in sbbs_t::xtrndat(const char *, const char *, unsigned char, unsigned int, unsigned int)()
1207 }
1208 bool write_ok = bbsdev_write(fp, lines, sizeof(lines) / sizeof(lines[0]));
1209 if (fclose(fp) != 0)
1210 write_ok = false;
1211 if (!write_ok) {
1212 errormsg(WHERE, ERR_WRITE, str, 0);

CID 654570: (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.

1213 remove(str);
1214 return false;
1215 }
1216 #if defined(_WIN32)
1217 int chmod_result = CHMOD(str, _S_IREAD);
1218 #else

** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()


_____________________________________________________________________________________________
*** CID 654569: Memory - illegal accesses (OVERRUN)
/xtrn_sec.cpp: 101 in bbsdev_language_tag_valid(const char *)()
95 || (lengths[at] == 4 && isdigit((unsigned char)parts[at][0])
96 && bbsdev_subtag_chars(parts[at] + 1, 3, isalnum))))
97 at++;
98 while (at < count && lengths[at] == 1
99 && tolower((unsigned char)parts[at][0]) != 'x') {
100 at++;

CID 654569: Memory - illegal accesses (OVERRUN)
Overrunning array "lengths" of 32 8-byte elements at element index 32 (byte offset 263) using index "at" (which evaluates to 32).

101 if (at == count || lengths[at] < 2)
102 return false;
103 while (at < count && lengths[at] >= 2)
104 at++;
105 }
106 if (at < count && lengths[at] == 1 && tolower((unsigned char)parts[at][0]) == 'x')

** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()


_____________________________________________________________________________________________
*** CID 654568: (RESOURCE_LEAK)
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }

CID 654568: (RESOURCE_LEAK)
Handle variable "fd" going out of scope leaks the handle.

1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);
/xtrn.cpp: 1925 in sbbs_t::external(const char *, int, const char *, const char *)()
1919 dup2(fd, STDOUT_FILENO);
1920 if (!(mode & EX_NOLOG))
1921 dup2(fd, STDERR_FILENO);
1922 if (fd > 2)
1923 close(fd);
1924 }

CID 654568: (RESOURCE_LEAK)
Handle variable "fd" going out of scope leaks the handle.

1925 }
1926
1927 if (mode & EX_BG) /* background execution, detach child */
1928 {
1929 if (daemon(TRUE, FALSE) != 0)
1930 lprintf(LOG_ERR, "!ERROR %d (%s) daemonizing: %s", errno, strerror(errno), argv[0]);


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview



---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)


** CID 656168: High impact quality (Y2K38_SAFETY)
/main.cpp: 4542 in update_client_ini(sbbs_t *, const long *)()


_____________________________________________________________________________________________
*** CID 656168: High impact quality (Y2K38_SAFETY)
/main.cpp: 4542 in update_client_ini(sbbs_t *, const long *)()
4536 iniCloseFile(fp);
4537 return;
4538 }
4539 iniSetUInteger(&ini, ROOT_SECTION, "user", (uint)sbbs->useron.number, NULL);
4540 iniSetString(&ini, ROOT_SECTION, "name", sbbs->useron.alias, NULL);
4541 if (done != NULL)

CID 656168: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "*done" is cast to "uint".

4542 iniSetUInteger(&ini, ROOT_SECTION, "done", (uint)*done, NULL);
4543 iniWriteFile(fp, ini);
4544 iniCloseFile(fp);
4545 iniFreeStringList(ini);
4546 }
4547


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview



---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)


** CID 656507: Error handling issues (CHECKED_RETURN) /tmp/sbbs-Sep-24-2026/src/xpdev/genwrap.c: 1530 in xp_pipe_open()


_____________________________________________________________________________________________
*** CID 656507: Error handling issues (CHECKED_RETURN) /tmp/sbbs-Sep-24-2026/src/xpdev/genwrap.c: 1530 in xp_pipe_open() 1524 FILE* fp;
1525
1526 /* A pipe is one-way, so the bidirectional mode gets a socket pair,
1527 which is what the BSD popen() uses for it. */
1528 if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != 0)
1529 return NULL;

CID 656507: Error handling issues (CHECKED_RETURN)
Calling "fcntl(sv[0], 2, 1)" without checking return value. This library function may fail and return an error code.

1530 fcntl(sv[0], F_SETFD, FD_CLOEXEC); /* our end isn't the command's */
1531 if ((pid = fork()) == 0) {
1532 close(sv[0]);
1533 dup2(sv[1], STDIN_FILENO);
1534 dup2(sv[1], STDOUT_FILENO);
1535 if (sv[1] > STDERR_FILENO)


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview



---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

5 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 5 of 5 defect(s)


** CID 656690: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2622 in js_add_cookieval(http_session_t *, const char *, const char *)()


_____________________________________________________________________________________________
*** CID 656690: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2622 in js_add_cookieval(http_session_t *, const char *, const char *)()
2616 errprintf(LOG_ERR, WHERE, "%04d %-5s [%s] failed to create JSString for cookie value '%s', key=%s"
2617 , session->socket, session->client.protocol, session->host_ip, value, key);
2618 else {
2619 lprintf(LOG_DEBUG, "%04d %-5s [%s] Adding cookie value %s=%s at pos %d"
2620 , session->socket, session->client.protocol, session->host_ip, key, value, alen);
2621 val = STRING_TO_JSVAL(js_str);

CID 656690: Error handling issues (CHECKED_RETURN)
Calling "JS_SetElement" without checking return value (as is done elsewhere 32 out of 40 times).

2622 JS_SetElement(session->js_cx, keyarray, alen, &val); 2623 }
2624 }
2625
2626 static void js_add_request_property(http_session_t * session, const char *key, const char *value, size_t len, bool writeable)
2627 {

** CID 656689: Error handling issues (CHECKED_RETURN)
/str.cpp: 1190 in sbbs_t::xfer_prot_menu(XFER_TYPE, user_t *, char *, unsigned long, const char *)()


_____________________________________________________________________________________________
*** CID 656689: Error handling issues (CHECKED_RETURN)
/str.cpp: 1190 in sbbs_t::xfer_prot_menu(XFER_TYPE, user_t *, char *, unsigned long, const char *)()
1184 for (int i = 0; i < cfg.total_prots; i++) {
1185 if (available(i) && count + 1 < size)
1186 keys[count++] = cfg.prot[i]->mnemonic; 1187 }
1188 keys[count] = '\0';
1189 if (extra_keys != nullptr)

CID 656689: Error handling issues (CHECKED_RETURN)
Calling "strlcat" without checking return value (as is done elsewhere 29 out of 31 times).

1190 strlcat(keys, extra_keys, size);
1191 set_cmd_keys(keys);
1192 }
1193 if (type == XFER_DOWNLOAD && current_file != nullptr)
1194 menu("download", P_NOERROR);
1195 bool menu_used = menu(prot_menu_file[type], P_NOERROR);

** CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON)


_____________________________________________________________________________________________
*** CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON) /js_console.cpp: 93 in js_key_str(JSContext *, char)()
87 , CON_PROP_OUTPUT_RATE
88 };
89
90 extern JSClass js_console_class;
91 static JSString* js_key_str(JSContext* cx, char key)
92 {

CID 656688: Memory - corruptions (ARRAY_VS_SINGLETON)
Passing "&key" to function "JS_NewStringCopyN" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.

93 return JS_NewStringCopyN(cx, &key, key == 0 ? 0 : 1);
94 }
95
96 static JSBool js_console_get(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
97 {
98 jsval idval;

** CID 656687: (CHECKED_RETURN)
/qwk.cpp: 456 in sbbs_t::qwk_download()()
/qwk.cpp: 417 in sbbs_t::qwk_download()()


_____________________________________________________________________________________________
*** CID 656687: (CHECKED_RETURN)
/qwk.cpp: 456 in sbbs_t::qwk_download()()
450 }
451 if (!sent) {
452 for (int i = 0; i < cfg.total_subs; i++)
453 subscan[i].ptr = sav_ptr[i];
454 last_ns_time = ns_time;
455 }

CID 656687: (CHECKED_RETURN)
Calling "remove(path)" without checking return value. This library function may fail and return an error code.

456 remove(path);
457 free(sav_ptr);
458 return sent;
459 }
460
461 /****************************************************************************/
/qwk.cpp: 417 in sbbs_t::qwk_download()()
411 return false;
412 }
413 for (int i = 0; i < cfg.total_subs; i++)
414 sav_ptr[i] = subscan[i].ptr;
415 snprintf(path, sizeof path, "%s%s.qwk", cfg.temp_dir, cfg.sys_id);
416 snprintf(fname, sizeof fname, "%s.qwk", cfg.sys_id);

CID 656687: (CHECKED_RETURN)
Calling "remove(path)" without checking return value. This library function may fail and return an error code.

417 remove(path);
418 if (pack_qwk(path, &msgcnt, /* prepack: */ false)) {
419 off_t l = flength(path);
420 bprintf(text[FiFilename], getfname(path));
421 bprintf(text[FiFileSize], u64toac(l, tmp)
422 , byte_estimate_to_str(l, tmp2, sizeof(tmp2), /* units: */ 1024, /* precision: */ 1));

** CID 656686: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2584 in js_add_queryval(http_session_t *, const char *, const char *)()


_____________________________________________________________________________________________
*** CID 656686: Error handling issues (CHECKED_RETURN)
/websrvr.cpp: 2584 in js_add_queryval(http_session_t *, const char *, const char *)()
2578 errprintf(LOG_ERR, WHERE, "%04d %-5s [%s] failed to create JSString for query value '%s', key=%s"
2579 , session->socket, session->client.protocol, session->host_ip, value, key);
2580 else {
2581 lprintf(LOG_DEBUG, "%04d %-5s [%s] Adding query value %s=%s at pos %d"
2582 , session->socket, session->client.protocol, session->host_ip, key, value, alen);
2583 val = STRING_TO_JSVAL(js_str);

CID 656686: Error handling issues (CHECKED_RETURN)
Calling "JS_SetElement" without checking return value (as is done elsewhere 32 out of 40 times).

2584 JS_SetElement(session->js_cx, keyarray, alen, &val); 2585 }
2586 }
2587
2588 static void js_add_cookieval(http_session_t * session, const char *key, const char *value)
2589 {


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview



---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

4 new defect(s) introduced to Synchronet found with Coverity Scan.
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 4 of 4 defect(s)


** CID 661304: Concurrent data access violations (MISSING_LOCK) /js_socket.cpp: 374 in do_js_close(JSContext *, js_socket_private_t *, bool)()


_____________________________________________________________________________________________
*** CID 661304: Concurrent data access violations (MISSING_LOCK) /js_socket.cpp: 374 in do_js_close(JSContext *, js_socket_private_t *, bool)()
368
369 static void do_js_close(JSContext *cx, js_socket_private_t *p, bool finalize)
370 {
371 size_t i;
372
373 if (p->tls_pending) {

CID 661304: Concurrent data access violations (MISSING_LOCK) >>> Accessing "p->tls_pending->sock" without holding lock "js_socket_tls_pending.mutex". Elsewhere, "js_socket_tls_pending.sock" is written to with "js_socket_tls_pending.mutex" held 1 out of 1 times.

374 SOCKET sock = p->tls_pending->sock;
375 // Cancellation precedes closing the notification endpoint.
376 js_socket_cancel_tls_private(p);
377 if (p->js_cb)
378 remove_js_socket_event(cx, p->js_cb, sock);
379 }

** CID 661303: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 1992 in finduserstr_ex()


_____________________________________________________________________________________________
*** CID 661303: Insecure data handling (INTEGER_OVERFLOW)
/userdat.c: 1992 in finduserstr_ex()
1986 overlapping a record another process holds locked fails; any record
1987 not read in bulk is then read singly, taking the lock. */
1988 size_t want = (size_t)count * USER_RECORD_LINE_LEN; 1989 size_t got = 0;
1990 if (seekuserdat(file, unum)) {
1991 while (got < want) {

CID 661303: Insecure data handling (INTEGER_OVERFLOW)
"want - got", which might have underflowed, is passed to "read(file, buf + got, want - got)".

1992 ssize_t rd = read(file, buf + got, want - got);
1993 if (rd <= 0)
1994 break;
1995 got += (size_t)rd;
1996 }
1997 }

** CID 661302: Error handling issues (CHECKED_RETURN)
/js_socket.cpp: 2648 in js_socket_tls_thread(void *)()


_____________________________________________________________________________________________
*** CID 661302: Error handling issues (CHECKED_RETURN)
/js_socket.cpp: 2648 in js_socket_tls_thread(void *)()
2642 if (status == CRYPT_OK && !cancelled)
2643 status = js_socket_activate_tls(pending->session, true, &pending->cert);
2644 pthread_mutex_lock(&pending->mutex);
2645 pending->status = status;
2646 /* The event endpoint remains open until cancellation has set this flag. */
2647 if (!pending->cancelled)

CID 661302: Error handling issues (CHECKED_RETURN)
Calling "send(pending->notify, "x", 1UL, 0)" without checking return value. This library function may fail and return an error code.

2648 send(pending->notify, "x", 1, 0);
2649 pthread_mutex_unlock(&pending->mutex);
2650 js_socket_complete_tls_worker(pending);
2651 }
2652
2653 JSBool js_socket_finish_tls(JSContext *cx, JSObject *obj)

** CID 661301: Concurrent data access violations (MISSING_LOCK) /js_socket.cpp: 2636 in js_socket_tls_thread(void *)()


_____________________________________________________________________________________________
*** CID 661301: Concurrent data access violations (MISSING_LOCK) /js_socket.cpp: 2636 in js_socket_tls_thread(void *)()
2630 static void js_socket_tls_thread(void *arg)
2631 {
2632 js_socket_tls_pending *pending = static_cast<js_socket_tls_pending *>(arg);
2633 SetThreadName("sbbs/jsTLS");
2634 int status = CRYPT_ERROR_NOTINITED;
2635 if (ssl_sync(pending->cfg, pending->logger)) {

CID 661301: Concurrent data access violations (MISSING_LOCK) >>> Accessing "pending->session" without holding lock "js_socket_tls_pending.mutex". Elsewhere, "js_socket_tls_pending.session" is written to with "js_socket_tls_pending.mutex" held 1 out of 1 times.

2636 status = add_private_key(pending->cfg, pending->logger, pending->session);
2637 pending->key_added = status == CRYPT_OK;
2638 }
2639 pthread_mutex_lock(&pending->mutex);
2640 bool cancelled = pending->cancelled;
2641 pthread_mutex_unlock(&pending->mutex);


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview



---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

1 new defect(s) introduced to Synchronet found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)


** CID 661775: Insecure data handling (TAINTED_SCALAR)


_____________________________________________________________________________________________
*** CID 661775: Insecure data handling (TAINTED_SCALAR)
/str.cpp: 655 in sbbs_t::read_sif_dat(char *, char *)()
649 return;
650 }
651 length = read(file, buf, length);
652 if (length < 0)
653 length = 0;
654 close(file);

CID 661775: Insecure data handling (TAINTED_SCALAR)
Passing tainted expression "*buf" to "sof", which uses it as an offset. 655 sof(siffile, buf, length);

656 free(buf);
657 }
658
659 static bool is_template_char(char ch)
660 {


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview



---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net