https://gitlab.synchro.net/main/sbbs/-/commit/573398dc0201f069d0d90bdc
Modified Files:
src/xpdev/msg_queue.c msg_queue.h
Log Message:
Use protected integer for reference counter

Fix concurrency issue reported by Claude via Deuce:
msgQueueAttach() (line 77) does q->refs++ and msgQueueDetach() (line 92) does
--q->refs on a plain int with no locking or atomics. These are non-atomic
read-modify-write operations.
If two threads call msgQueueDetach() concurrently with refs == 2:
- Both read refs == 2, both write refs = 1, neither triggers the == 0 free →
memory leak
If two threads call msgQueueDetach() concurrently with refs == 1:
- Both read refs == 1, both write refs = 0, both call msgQueueFree() →
double-free
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)