fix fortify scan issues: add final, remove double lock