Hi,
Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.
4 new defect(s) introduced to Synchronet found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 4 of 4 defect(s)
** CID 645010: Insecure data handling (INTEGER_OVERFLOW) /tmp/sbbs-Mar-17-2026/src/conio/wl_events.c: 1136 in ds_send()
_____________________________________________________________________________________________
*** CID 645010: Insecure data handling (INTEGER_OVERFLOW) /tmp/sbbs-Mar-17-2026/src/conio/wl_events.c: 1136 in ds_send()
1130 {
1131 assert_pthread_mutex_lock(&wl_copybuf_mutex);
1132 if (wl_copybuf) {
1133 size_t len = strlen(wl_copybuf);
1134 size_t sent = 0;
1135 while (sent < len) {
CID 645010: Insecure data handling (INTEGER_OVERFLOW)
"len - sent", which might have underflowed, is passed to "write(fd, wl_copybuf + sent, len - sent)".
1136 ssize_t rv = write(fd, wl_copybuf + sent, len - sent);
1137 if (rv <= 0)
1138 break;
1139 sent += rv;
1140 }
1141 }
** CID 645009: Insecure data handling (INTEGER_OVERFLOW) /tmp/sbbs-Mar-17-2026/src/conio/wl_events.c: 1459 in readev()
_____________________________________________________________________________________________
*** CID 645009: Insecure data handling (INTEGER_OVERFLOW) /tmp/sbbs-Mar-17-2026/src/conio/wl_events.c: 1459 in readev()
1453 readev(struct wl_local_event *lev)
1454 {
1455 size_t got = 0;
1456 char *buf = (char *)lev;
1457
1458 while (got < sizeof(*lev)) {
CID 645009: Insecure data handling (INTEGER_OVERFLOW)
"96UL - got", which might have underflowed, is passed to "read(wl_local_pipe[0], buf + got, 96UL - got)".
1459 int rv = read(wl_local_pipe[0], buf + got, sizeof(*lev) - got);
1460 if (rv > 0)
1461 got += rv;
1462 }
1463 }
1464
** CID 645008: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Mar-17-2026/src/conio/wl_cio.c: 243 in wl_copytext()
_____________________________________________________________________________________________
*** CID 645008: Concurrent data access violations (MISSING_LOCK) /tmp/sbbs-Mar-17-2026/src/conio/wl_cio.c: 243 in wl_copytext()
237
238 assert_pthread_mutex_lock(&wl_copybuf_mutex);
239 FREE_AND_NULL(wl_copybuf);
240 wl_copybuf = strdup(text);
241 assert_pthread_mutex_unlock(&wl_copybuf_mutex);
242
CID 645008: Concurrent data access violations (MISSING_LOCK) >>> Accessing "wl_copybuf" without holding lock "wl_copybuf_mutex". Elsewhere, "wl_copybuf" is written to with "wl_copybuf_mutex" held 2 out of 2 times.
243 if (wl_copybuf) {
244 ev.type = WL_LOCAL_COPY;
245 write_event(&ev);
246 }
247 }
248
** CID 645007: Program hangs (SLEEP)
_____________________________________________________________________________________________
*** CID 645007: Program hangs (SLEEP) /tmp/sbbs-Mar-17-2026/src/conio/ciolib.c: 2754 in ciolib_add_hyperlink()
2748 }
2749 }
2750
2751 /* Run GC if free list is empty */
2752 if (hyperlink_free_head == 0)
2753 hyperlink_gc();
CID 645007: Program hangs (SLEEP)
Call to "hyperlink_gc" might sleep while holding lock "hyperlink_mutex".
2754
2755 /* Still empty after GC table is full */
2756 if (hyperlink_free_head == 0) {
2757 pthread_mutex_unlock(&hyperlink_mutex);
2758 return 0;
2759 }
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit,
https://scan.coverity.com/projects/synchronet?tab=overview
---
* Synchronet * Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net