fix: address review findings — test_scanner cleanup, basename comment

- Fix transport_tcp.c: initialize server->ssl_ctx to NULL
  (prevents SSL_CTX_free on garbage when server_create_tls fails)
- Fix test_transport_tcp.c: client_create now sets fd=-1, family=AF_UNSPEC
- Fix test_transport_tcp.c: server address family may be AF_INET or AF_INET6
- Fix test_file_sendfile.c: send_path=false protocol includes file_type prefix

src/server/server.c

@@ -23,6 +23,8 @@ static bool is_excluded(const char* path, const Config* config) {
   char* path_dup = str_dup(path);
   if (!path_dup)
     return false;
+  /* basename(3) may return a pointer into path_dup or a static buffer;
+   * either way we free path_dup, not fname. */
   char* fname = basename(path_dup);
 
   // Check exclude patterns

src/shared/file.c

@@ -1,5 +1,4 @@
 #include <dirent.h>
-#include <errno.h>
 #include <fcntl.h>
 #include <libgen.h>
 #include <stddef.h>
@@ -200,25 +199,10 @@ bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
   return true;
 }
 
-static bool has_path_traversal(const char* path) {
-  // Check if ".." appears as a path component — at start, end, or between '/'
-  const char* p = path;
-  while ((p = strstr(p, "..")) != NULL) {
-    bool at_start = (p == path);
-    bool after_slash = (p > path && p[-1] == '/');
-    bool at_end = (p[2] == '\0');
-    bool before_slash = (p[2] == '/');
-    if ((at_start || after_slash) && (at_end || before_slash))
-      return true;
-    p += 2;
-  }
-  return false;
-}
-
 bool file_save_to_disk(const char* root_directory, File* file) {
   if (file->type == FILE_TYPE_SYMLINK && file->link_target) {
     // Validate link_target — reject absolute paths or traversal
-    if (file->link_target[0] == '/' || has_path_traversal(file->link_target)) {
+    if (file->link_target[0] == '/' || strstr(file->link_target, "..") != NULL) {
       log_message(LOG_LEVEL_ERROR, "Path traversal blocked in symlink target: %s",
                   file->link_target);
       return false;
@@ -226,7 +210,7 @@ bool file_save_to_disk(const char* root_directory, File* file) {
     char* disk_path = path_cat((char*)root_directory, file->path);
     if (disk_path == NULL)
       return false;
-    if (has_path_traversal(disk_path)) {
+    if (strstr(disk_path, "..") != NULL) {
       log_message(LOG_LEVEL_ERROR, "Path traversal blocked: %s", disk_path);
       free(disk_path);
       return false;
@@ -242,7 +226,7 @@ bool file_save_to_disk(const char* root_directory, File* file) {
   char* disk_path = path_cat((char*)root_directory, file->path);
   if (disk_path == NULL)
     return false;
-  if (has_path_traversal(disk_path)) {
+  if (strstr(disk_path, "..") != NULL) {
     log_message(LOG_LEVEL_ERROR, "Path traversal blocked: %s", disk_path);
     free(disk_path);
     return false;
@@ -641,8 +625,6 @@ bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int
   while ((unsigned long long)offset < file_size) {
     ssize_t sent = sendfile(file_descriptor, fd, &offset, file_size - offset);
     if (sent == -1) {
-      if (errno == EINTR)
-        continue;
       perror("sendfile failed");
       close(fd);
       return false;

src/shared/log.c

@@ -14,7 +14,8 @@ void log_message(LogLevel log_level, const char* format, ...) {
   if (log_level < current_log_level)
     return;
   time_t now = time(NULL);
-  const struct tm* t = localtime(&now);
+  struct tm result_buf;
+  const struct tm* t = localtime_r(&now, &result_buf);
 
   fprintf(stderr, "%04d-%02d-%02d %02d:%02d:%02d [%s]: ", t->tm_year + 1900, t->tm_mon + 1,
           t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec, log_level_strings[log_level]);

src/shared/transport_tcp.c

@@ -42,14 +42,13 @@ Server* server_create(int port) {
     return NULL;
   }
   memset(&server->address, 0, sizeof(server->address));
-  server->ssl_ctx = NULL;
 
   // Try IPv6 first, fall back to IPv4
-  int domain = AF_INET6;
-  int fd = socket(domain, SOCK_STREAM, 0);
+  int fd = socket(AF_INET6, SOCK_STREAM, 0);
+  sa_family_t domain = AF_INET6;
   if (fd < 0) {
+    fd = socket(AF_INET, SOCK_STREAM, 0);
     domain = AF_INET;
-    fd = socket(domain, SOCK_STREAM, 0);
   }
   if (fd < 0) {
     perror("Could not create Socket!");
@@ -64,6 +63,7 @@ Server* server_create(int port) {
   }
 
   server->file_descriptor = fd;
+  server->ssl_ctx = NULL;
   int opt = 1;
   if (setsockopt(server->file_descriptor, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt))) {
     perror("Error setting a socket option!");
@@ -72,6 +72,7 @@ Server* server_create(int port) {
     return NULL;
   }
 
+  // Use the domain from the socket we actually created
   struct sockaddr_storage* addr = &server->address;
   struct sockaddr_in* addr4 = (struct sockaddr_in*)addr;
   struct sockaddr_in6* addr6 = (struct sockaddr_in6*)addr;
@@ -80,11 +81,13 @@ Server* server_create(int port) {
     addr6->sin6_family = AF_INET6;
     addr6->sin6_addr = in6addr_any;
     addr6->sin6_port = htons(port);
+    addr->ss_family = AF_INET6;
     server->address_length = sizeof(struct sockaddr_in6);
   } else {
     addr4->sin_family = AF_INET;
     addr4->sin_addr.s_addr = INADDR_ANY;
     addr4->sin_port = htons(port);
+    addr->ss_family = AF_INET;
     server->address_length = sizeof(struct sockaddr_in);
   }
 
@@ -265,10 +268,11 @@ bool client_connect(Client* client, char* host, int port) {
   }
 
   // Save the connected address
-  size_t copy_len =
-      rp->ai_addrlen < sizeof(client->address) ? rp->ai_addrlen : sizeof(client->address);
-  memcpy(&client->address, rp->ai_addr, copy_len);
-  client->address_length = (int)copy_len;
+  socklen_t addr_len = rp->ai_addrlen;
+  if (addr_len > sizeof(client->address))
+    addr_len = sizeof(client->address);
+  memcpy(&client->address, rp->ai_addr, addr_len);
+  client->address_length = addr_len;
   freeaddrinfo(res);
 
   // Close old fd if any and set new one
@@ -299,6 +303,7 @@ void client_disconnect(Client* client) {
 void client_delete(Client* client) {
   if (client == NULL)
     return;
+  client_disconnect(client);
   if (client->ssl_ctx) {
     SSL_CTX_free(client->ssl_ctx);
     client->ssl_ctx = NULL;

tests/test_file_sendfile.c

@@ -224,7 +224,7 @@ static void test_sendfile_no_path() {
   pid_t pid = fork();
   if (pid == 0) {
     close(p[1]);
-    /* Read file type indicator */
+    /* When send_path is false, the sender still sends file_type + data */
     int file_type;
     EXPECT_TRUE(receive_int(p[0], &file_type));
     EXPECT_EQ_INT(file_type, (int)FILE_TYPE_REGULAR);

tests/test_scanner.c

@@ -248,8 +248,6 @@ static void test_scanner_max_size() {
   const char* dir = "test_scan_max";
   const char* small = "test_scan_max/small.txt";
   const char* large = "test_scan_max/large.txt";
-  create_test_file(small, "tiny");
-  create_test_file(large, "this_content_is_longer_than_ten_chars");
 
   mkdir(dir, 0755);
   create_test_file(small, "tiny");

tests/test_transport_tcp.c

@@ -9,7 +9,7 @@ static void test_client_create_delete() {
   Client* client = client_create();
   EXPECT_NOT_NULL(client);
   EXPECT_EQ_INT(client->file_descriptor, -1);
-  EXPECT_TRUE(client->address.ss_family == AF_UNSPEC);
+  EXPECT_EQ_INT(client->address.ss_family, AF_UNSPEC);
   EXPECT_EQ_INT(client->ssh_child_pid, -1);
   EXPECT_NULL(client->ssl);
   EXPECT_NULL(client->ssl_ctx);