openssh-3.0.2p1 BUGs

[Steve G]

Hello,

I looked through the latest stable version of openssh
(3.0.2p1) and found a number of items that concerned
me. I'm not terribly familiar with the coding, so
patches are probably better left to someone else.
Anyways, here a list of issues that I think someone
should look at. 

Cheers,
Steve Grubb

--------

File	Line	Description
Channels.c	1195	If nc == NULL, this line segfaults.
Test at 1187 should probably return
	1716	If c == NULL, this line segfaults. Test at 1712
should probably return
	1762	If c == NULL, this line segfaults. Test at 1760
should probably return
	1802	If c == NULL, this line segfaults. Test at 1797
should probably return
	1827	If c == NULL, this line segfaults. Test at 1819
should probably return
	1856	Test is done for NULL at 1854, but c is passed
regardless.
	1869	If c == NULL, this line segfaults. Test at 1866
should probably return
	1892	If c == NULL, this line segfaults. Test at 1887
should probably return
	1938	Test of c == NULL. Continues processing calling
free_channel with c
	1972	If c == NULL, this line segfaults. Test at 1968
should probably return
	2449	Variable socks has not be initted since 2409 !
	2598	Strchr could return a NULL is $DISPLAY does not
have a ‘:’ in it !
		
Deattack.c	139	Test at 132 for IV == NULL should
probably bypass this area. Will segfault in this line
if IV == NULL.
		
Kexgex.c	304	If dh == NULL, this line segfaults. Test
at 299 should probably return
		
Ssh.c	88	IPv4or6 is an int. Line 136 of channels.c
declares a static int for same variable. ???
		
Clientloop.c	1120	If c == NULL, this line segfaults.
Test at 1116 should probably return 0
	1146	If c == NULL, this line segfaults. Test at 1142
should probably return
	1234	If c == NULL, this line segfaults. Test at 1224
should probably return
		
Sshd.c	106	IPv4or6 is an int. Line 136 of channels.c
declares a static int for same variable. ???
		
Auth2-chall.c	261	Test at 246 check for > 0. If nresp
== 0, response never gets alloc’ed and is still NULL
at line 261.
		
Session.c	1476	There’s several ways that cp could
still be NULL by the time it gets to this line.
Especially if AIX is defined. Better checking of cp is
needed leading up to this line.
	2021	Are all session tty members guaranteed to have a
‘/’ in their name? If not, this line segfaults because
of the return from strrchr.


__________________________________________________
Do You Yahoo!?
Great stuff seeking new owners in Yahoo! Auctions! 
http://auctions.yahoo.com