openssh bugs - Mar 2012 - [Bug 1990] New: sftp segfaults when tab-completing a directory which contains umlauts

https://bugzilla.mindrot.org/show_bug.cgi?id=1990

             Bug #: 1990
           Summary: sftp segfaults when tab-completing a directory which
                    contains umlauts
    Classification: Unclassified
           Product: Portable OpenSSH
           Version: 5.9p1
          Platform: amd64
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: sftp
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: stefan.weichselbaumer at googlemail.com


$ mkdir test?
$ sftp localhost
Connected to localhost.
sftp> cd /tmp/test
sftp> cd tes<TAB>[1]    24810 segmentation fault  sftp localhost

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1990

Guillaume ALAUX <guillaume at alaux.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |guillaume at alaux.net

--- Comment #1 from Guillaume ALAUX <guillaume at alaux.net> 2012-03-18
10:11:44 EST ---
I reproduce this with sftp-server from openssh 5.9p1 on folder or file
with names containing French accents.

Compiled with [0]:

    ./configure \
        --prefix=/usr \
        --libexecdir=/usr/lib/ssh \
        --sysconfdir=/etc/ssh \
        --with-privsep-user=nobody \
        --with-md5-passwords \
        --with-pam \
        --with-mantype=man \
        --with-xauth=/usr/bin/xauth \
        --with-kerberos5=/usr \
        --with-ssl-engine \
        --with-libedit=/usr/lib \
        --disable-strip
    make

When using "sftp-server -l DEBUG3", I get:

Mar 17 23:25:43 localhost sftp-server[1495]: debug3: request 97:
opendir
Mar 17 23:25:43 localhost sftp-server[1495]: opendir
"/mnt/data/music/AudioSlave/../Klub des Loosers/"
Mar 17 23:25:43 localhost sftp-server[1495]: debug1: request 97: sent
handle handle 0
Mar 17 23:25:43 localhost sftp-server[1495]: debug1: request 98:
readdir "/mnt/data/music/AudioSlave/../Klub des Loosers/" (handle 0)
Mar 17 23:25:43 localhost sftp-server[1495]: debug1: request 98: sent
names count 4
Mar 17 23:25:43 localhost sftp-server[1495]: debug1: request 99:
readdir "/mnt/data/music/AudioSlave/../Klub des Loosers/" (handle 0)
Mar 17 23:25:43 localhost sftp-server[1495]: debug3: request 99: sent
status 1
Mar 17 23:25:43 localhost sftp-server[1495]: sent status End of file
Mar 17 23:25:43 localhost sftp-server[1495]: debug3: request 100: close
handle 0
Mar 17 23:25:43 localhost sftp-server[1495]: closedir
"/mnt/data/music/AudioSlave/../Klub des Loosers/"
Mar 17 23:25:43 localhost sftp-server[1495]: debug3: request 100: sent
status 0
Mar 17 23:25:43 localhost sftp-server[1495]: sent status Success
Mar 17 23:25:43 localhost sftp-server[1495]: debug3: request 101: lstat
Mar 17 23:25:43 localhost sftp-server[1495]: lstat name
"/mnt/data/music/AudioSlave/../Klub des Loosers/2012 - La Fin De
L'Esp\303\250ce"
Mar 17 23:25:43 localhost sftp-server[1495]: debug1: request 101: sent
attrib have 0xf
Mar 17 23:25:43 localhost sftp-server[1495]: debug1: read eof
Mar 17 23:25:43 localhost sftp-server[1495]: session closed for local
user miguel from [192.168.0.6]
Mar 17 23:25:43 localhost sshd[1494]: Received disconnect from
192.168.0.6: 11: disconnected by user
Mar 17 23:25:43 localhost sshd[1485]: pam_unix_session(sshd:session):
session closed for user miguel

Then the client crashes with output "segmentation fault". "echo
$?"
gives "139".


[0]
http://projects.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/openssh

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1990

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #2 from Damien Miller <djm at mindrot.org> 2012-03-30 10:29:40
EST ---
I can't replicate this on Goobuntu precise:

$ cd /tmp
$ touch xxx?xxx
$ sftp -D /usr/lib/openssh/sftp-server
sftp> ls xxx<TAB>
(expands to)
sftp> ls xxx\303\274xx
xxx?xxx
sftp>

Perhaps it is locale dependent?

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.