Subj : New Defects reported by Coverity Scan for Synchronet
To   : All
From : scan-admin@coverity.com
Date : Mon Sep 07 2026 14:25:22


----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi,

Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.

2 new defect(s) introduced to Synchronet found with Coverity Scan.


New defect(s) Reported-by: Coverity Scan
Showing 2 of 2 defect(s)


** CID 655740:       Concurrent data access violations  (MISSING_LOCK)
/tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501           in sdl_init()


_____________________________________________________________________________________________
*** CID 655740:         Concurrent data access violations  (MISSING_LOCK)
/tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501             in sdl_init()
495     	_beginthread(sdl_video_event_thread, 0, NULL);
496     #endif
497     	sdl_user_func_ret(SDL_USEREVENT_INIT);
498     	sdl_init_mode(ciolib_initial_mode);
499
500     	if(sdl_init_good) {
>>>     CID 655740:         Concurrent data access violations  (MISSING_LOCK)
>>>     Accessing "fullscreen" without holding lock "win_mutex". Elsewhere, "fullscreen" is written to with "win_mutex" held 3 out of 3 times (3 of these accesses strongly imply that it is necessary).
501     		cio_api.mode=fullscreen?CIOLIB_MODE_SDL_FULLSCREEN:CIOLIB_MODE_SDL;
502     #ifdef _WIN32
503     		FreeConsole();
504     #endif
505     		cio_api.options |= CONIO_OPT_PALETTE_SETTING | CONIO_OPT_SET_TITLE | CONIO_OPT_SET_NAME | CONIO_OPT_SET_ICON | CONIO_OPT_EXTERNAL_SCALING | CONIO_OPT_KEY_EVENTS;
506     		return(0);

** CID 655739:         (ATOMICITY)
/main.cpp: 2782           in output_thread(void *)()
/main.cpp: 2764           in output_thread(void *)()


_____________________________________________________________________________________________
*** CID 655739:           (ATOMICITY)
/main.cpp: 2782             in output_thread(void *)()
2776     						/* Handle the SSH error here. The lprintf inside GCESSTR
2777     						 * runs while ssh_mutex is held; releasing+reacquiring it
2778     						 * across the error report would make the error-handling
2779     						 * sequence racy (ssh_errors++, online=FALSE) and is the
2780     						 * wrong tradeoff for a fast log write. */
2781     						// coverity[SLEEP:SUPPRESS]
>>>     CID 655739:           (ATOMICITY)
>>>     Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.
2782     						GCESSTR(err, node, sbbs->ssh_session, "pushing data");
2783     						sbbs->online = false;
2784     						sendbytes = buftop - bufbot;
2785     						i = sendbytes;    // Pretend we sent it all
2786     					}
2787     					else {
/main.cpp: 2764             in output_thread(void *)()
2758     			}
2759     			if (sbbs->session_channel == -1) {
2760     				i = sendbytes;    // Pretend we sent it all
2761     			}
2762     			else {
2763     				if (cryptStatusError((err = cryptSetAttribute(sbbs->ssh_session, CRYPT_SESSINFO_SSH_CHANNEL, sbbs->session_channel)))) {
>>>     CID 655739:           (ATOMICITY)
>>>     Using an unreliable value of "GCES_level" inside the second locked section. If the data that "GCES_level" depends on was changed by another thread, this use might be incorrect.
2764     					GCESSTR(err, node, sbbs->ssh_session, "setting channel");
2765     					sbbs->online = false;
2766     					i = sendbytes;    // Pretend we sent it all
2767     				}
2768     				else {
2769     					/*


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/synchronet?tab=overview


----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
<head>
  <meta charset="UTF-8">
  <title>New Defects Reported - Synchronet</title>
  <style>
    body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
    .button {
      display: inline-block;
      padding: 10px 20px;
      margin: 20px 0;
      font-size: 16px;
      color: #fff !important;
      background-color: #0056b3;
      text-decoration: none;
      border-radius: 5px;
    }
    pre {
      background: #f8f9fa;
      padding: 10px;
      border-radius: 5px;
      font-size: 14px;
      overflow-x: auto;
    }
  </style>
</head>
<body>
  <p>Hi,</p>

  <p>
    Please find the latest report on new defect(s) introduced to <strong>Synchronet</strong>
     found with Coverity Scan.
  </p>

  <ul>
    <li><strong>New Defects Found:</strong> 2</li>
    <li><strong>Defects Shown:</strong> Showing 2 of 2 defect(s)</li>
  </ul>

  <h3>Defect Details</h3>
  <pre>
** CID 655740:       Concurrent data access violations  (MISSING_LOCK)
/tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501           in sdl_init()


_____________________________________________________________________________________________
*** CID 655740:         Concurrent data access violations  (MISSING_LOCK)
/tmp/sbbs-Sep-07-2026/src/conio/sdl_con.c: 501             in sdl_init()
495     	_beginthread(sdl_video_event_thread, 0, NULL);
496     #endif
497     	sdl_user_func_ret(SDL_USEREVENT_INIT);
498     	sdl_init_mode(ciolib_initial_mode);
499
500     	if(sdl_init_good) {
&gt;&gt;&gt;     CID 655740:         Concurrent data access violations  (MISSING_LOCK)
&gt;&gt;&gt;     Accessing &quot;fullscreen&quot; without holding lock &quot;win_mutex&quot;. Elsewhere, &quot;fullscreen&quot; is written to with &quot;win_mutex&quot; held 3 out of 3 times (3 of these accesses strongly imply that it is necessary).
501     		cio_api.mode=fullscreen?CIOLIB_MODE_SDL_FULLSCREEN:CIOLIB_MODE_SDL;
502     #ifdef _WIN32
503     		FreeConsole();
504     #endif
505     		cio_api.options |= CONIO_OPT_PALETTE_SETTING | CONIO_OPT_SET_TITLE | CONIO_OPT_SET_NAME | CONIO_OPT_SET_ICON | CONIO_OPT_EXTERNAL_SCALING | CONIO_OPT_KEY_EVENTS;
506     		return(0);

** CID 655739:         (ATOMICITY)
/main.cpp: 2782           in output_thread(void *)()
/main.cpp: 2764           in output_thread(void *)()


_____________________________________________________________________________________________
*** CID 655739:           (ATOMICITY)
/main.cpp: 2782             in output_thread(void *)()
2776     						/* Handle the SSH error here. The lprintf inside GCESSTR
2777     						 * runs while ssh_mutex is held; releasing+reacquiring it
2778     						 * across the error report would make the error-handling
2779     						 * sequence racy (ssh_errors++, online=FALSE) and is the
2780     						 * wrong tradeoff for a fast log write. */
2781     						// coverity[SLEEP:SUPPRESS]
&gt;&gt;&gt;     CID 655739:           (ATOMICITY)
&gt;&gt;&gt;     Using an unreliable value of &quot;GCES_level&quot; inside the second locked section. If the data that &quot;GCES_level&quot; depends on was changed by another thread, this use might be incorrect.
2782     						GCESSTR(err, node, sbbs-&gt;ssh_session, &quot;pushing data&quot;);
2783     						sbbs-&gt;online = false;
2784     						sendbytes = buftop - bufbot;
2785     						i = sendbytes;    // Pretend we sent it all
2786     					}
2787     					else {
/main.cpp: 2764             in output_thread(void *)()
2758     			}
2759     			if (sbbs-&gt;session_channel == -1) {
2760     				i = sendbytes;    // Pretend we sent it all
2761     			}
2762     			else {
2763     				if (cryptStatusError((err = cryptSetAttribute(sbbs-&gt;ssh_session, CRYPT_SESSINFO_SSH_CHANNEL, sbbs-&gt;session_channel)))) {
&gt;&gt;&gt;     CID 655739:           (ATOMICITY)
&gt;&gt;&gt;     Using an unreliable value of &quot;GCES_level&quot; inside the second locked section. If the data that &quot;GCES_level&quot; depends on was changed by another thread, this use might be incorrect.
2764     					GCESSTR(err, node, sbbs-&gt;ssh_session, &quot;setting channel&quot;);
2765     					sbbs-&gt;online = false;
2766     					i = sendbytes;    // Pretend we sent it all
2767     				}
2768     				else {
2769     					/*

  </pre>

  <p>
    <a href="https://scan.coverity.com/projects/synchronet?tab=overview" class="button">View Defects in Coverity Scan</a>
  </p>

  <p>Best regards,</p>
  <p>The Coverity Scan Admin Team</p>
  <img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>
----==_mimepart_6a9ec9519c7f0_2264d92b3f152419ac2938d--

--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.