https://gitlab.synchro.net/main/sbbs/-/commit/e3c1569fc5a74ca9bb76c62c
Modified Files:
src/sbbs3/ssl.c
Log Message:
ssl: assert CRYPTLIB_PATCHES literal is at least 32 chars (CID 483188)

CRYPTLIB_PATCHES is generated at build time by 3rdp/build/hashpatch.pl
as a 32-char MD5 plus " -" (36 bytes including NUL). If hashpatch.pl
fails to run, the macro can be left empty, and the existing
memcmp(patches, CRYPTLIB_PATCHES, 32) reads 32 bytes off the end of a
1-byte empty literal — Coverity flags this as OVERRUN. Add a
_Static_assert at the top of internal_do_cryptInit() so a malformed
build fails to compile instead of producing a binary that may either
overrun or run a broken patch check.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/0f04514cb45809851b631961
Modified Files:
src/sbbs3/ssl.c
Log Message:
ssl: cast DO() to void in get_ssl_cert key load (CID 544155)

The cryptGetPrivateKey result is captured via the cert_entry->cert out-parameter and the loop's 'cert == -1' check, which is the actual
condition the caller acts on. The DO() macro return is informational
only here. Make the discarded return explicit.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/a62f38d5ba9491e2c89227d7
Modified Files:
src/sbbs3/ssl.c
Log Message:
ssl: fix macOS build of internal_do_cryptInit (CID 483188 follow-up)

e3c1569fc added a _Static_assert that CRYPTLIB_PATCHES is at least
32 chars, but some build configs (macOS, exec/testbuild.js nightly)
define it empty to deliberately skip the patch-version check. The
assert tripped that build.

Replace the assert with a sizeof() runtime guard wrapping the cryptGetAttributeString / memcmp / asprintf block. Compilers fold
the sizeof comparison constant per build, so:
- When CRYPTLIB_PATCHES is the real 36-byte literal, the block is
kept and Coverity sees the memcmp is safely bounded.
- When CRYPTLIB_PATCHES is "", the block is dropped entirely and
we never attempt the 32-byte read past the empty literal.

GitLab CI pipelines pass; this only affects the nightly testbuild configurations that leave CRYPTLIB_PATCHES empty.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)