openssh bugs - Jan 2022 - [Bug 3385] New: prints CR from comment which leads to unreliable output

https://bugzilla.mindrot.org/show_bug.cgi?id=3385

            Bug ID: 3385
           Summary: prints CR from comment which leads to unreliable
                    output
           Product: Portable OpenSSH
           Version: 8.8p1
          Hardware: Other
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh-keygen
          Assignee: unassigned-bugs at mindrot.org
          Reporter: glebfm at altlinux.org

$ rm -f test*; ./ssh-keygen -q -t rsa -C test at test -N '' -f test
$ ./ssh-keygen -l -f test.pub 
3072 SHA256:Fh8V9v/JyBFlGI0ZqvWMb6480Ldm9dF0XJGTZFnoosI test at test (RSA)
$ unix2dos -q test.pub
$ ./ssh-keygen -l -f test.pub 
 (RSA)HA256:Fh8V9v/JyBFlGI0ZqvWMb6480Ldm9dF0XJGTZFnoosI test at test

Looks like this happens because ssh-keygen treats CR byte as a part of
the comment.

$ read -r key < test.pub
$ printf '%s\r9999 SHA256:deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdea
good at key\n' "$key" > bad.pub
$ ./ssh-keygen -l -f bad.pub 
9999 SHA256:deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdea good at key (RSA)
$ ./ssh-keygen -l -f bad.pub | less
3072 SHA256:rDIBjjZQEjZTzR3GIp/KERSlnMtsxeFrAbeye6TRoI0 test at test^M9999
SHA256:deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdea good at key (RSA)


git bisect shows that the c56a255162c2166884539c0a1f7511575325b477
commit introduced this regression.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3385

Jakub Jelen <jjelen at redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jjelen at redhat.com

--- Comment #1 from Jakub Jelen <jjelen at redhat.com> ---
This was already reported as bug #3283 last year with a patch,
unfortunately, without any response neither here nor on github:

https://github.com/openssh/openssh-portable/pull/236/files

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3385

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org
         Resolution|---                         |FIXED
             Blocks|                            |3740
             Status|NEW                         |RESOLVED

--- Comment #2 from Damien Miller <djm at mindrot.org> ---
Fixed in 6993d9f09, will be in openssh-10.0 - thanks


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=3740
[Bug 3740] Tracking bug for OpenSSH 10.0
-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.