openssh bugs - Jul 2008 - [Bug 1496] New: ssh fails with xmalloc: zero size

https://bugzilla.mindrot.org/show_bug.cgi?id=1496

           Summary: ssh fails with xmalloc: zero size
    Classification: Unclassified
           Product: Portable OpenSSH
           Version: 5.1p1
          Platform: Other
        OS/Version: Linux
            Status: NEW
          Keywords: patch
          Severity: normal
          Priority: P2
         Component: ssh
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: t8m at centrum.cz


Created an attachment (id=1553)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1553)
Patch which fixes the zero length banner problem.

ssh fails with xmalloc: zero size when connecting to a server with
present but empty banner.

Also the processing of the received banner through strnvis() is
unfortunate in the regard that it mangles banners with international
characters. The processing should be done according to the current
locale and allow the international characters to be printed unmangled.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1496


Tomas Mraz <t8m at centrum.cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #1553|0                           |1
        is obsolete|                            |




--- Comment #1 from Tomas Mraz <t8m at centrum.cz>  2008-07-31 19:21:05
---
Created an attachment (id=1554)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1554)
Correct patch

Actually according to the strnvis man page the dest must be null
terminated in case the len is 0 or all the characters are expanded to 4
times length.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1496


Josh Triplett <josh at freedesktop.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |josh at freedesktop.org




--- Comment #2 from Josh Triplett <josh at freedesktop.org>  2008-08-07
05:56:25 ---
I can confirm this problem.  I observed it when attempting to connect
to the management module of an IBM BladeCenter via SSH.  It did not
occur with previous versions of SSH.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1496


Colin Watson <cjwatson at debian.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |cjwatson at debian.org




--- Comment #3 from Colin Watson <cjwatson at debian.org>  2008-08-29
23:50:26 ---
Shouldn't you pass len * 4 + 1 as the third argument to strnvis too?
openbsd-compat/vis.c says:

 *      Strnvis will write no more than siz-1 bytes (and will NULL
terminate).

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1496





--- Comment #4 from Tomas Mraz <t8m at centrum.cz>  2008-08-30 20:25:31
---
Hmm, yes. The current patch means that in case that all characters are
expanded, the last character of the expanded string will be truncated.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1496


Mike Frysinger <vapier at gentoo.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |vapier at gentoo.org




--- Comment #5 from Mike Frysinger <vapier at gentoo.org>  2008-11-03
19:41:10 ---
this has been fixed in openbsd now:
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshconnect2.c.diff?r1=1.166;r2=1.168

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1496


Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED
                 CC|                            |djm at mindrot.org
             Blocks|                            |1481




--- Comment #6 from Damien Miller <djm at mindrot.org>  2009-01-21
20:12:50 ---
Yes, this will be in openssh-5.2

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1496


Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED




--- Comment #7 from Damien Miller <djm at mindrot.org>  2009-02-23
13:35:57 ---
Close bugs fixed/reviewed for openssh-5.2 release

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.