[Bug 130] New: segfault on connect / Red Hat 6.1 w/OpenSSL 0.9.6c

[bugzilla-daemon at mindrot.org]

http://bugzilla.mindrot.org/show_bug.cgi?id=130

           Summary: segfault on connect / Red Hat 6.1 w/OpenSSL 0.9.6c
           Product: Portable OpenSSH
           Version: 3.0.2p1
          Platform: ix86
        OS/Version: Linux
            Status: NEW
          Severity: critical
          Priority: P2
         Component: ssh
        AssignedTo: openssh-unix-dev at mindrot.org
        ReportedBy: jon at xisp.net


The client segfaults and I'm afraid the server is doing the same thing since it
dies when I try to connect.                         
                                                             
I just built openssl 0.9.6c, which appears to be the most recent version, and it
passed the 'make test' routines, so that appears not to be the problem. It's an
old Red Hat 6.1 box that's on-site and thus can't be replaced or safely
upgraded.     

[root at andromeda openssh-3.0.2p1]# gdb ./ssh      
GNU gdb 4.18                                   
Copyright 1998 Free Software Foundation, Inc.  
GDB is free software, covered by the GNU General Public License, and you are 
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.  
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(gdb) run -v jon at leapfrog.baltimorons.org
Starting program: /usr/src/openssh-3.0.2p1/./ssh -v jon at leapfrog.baltimorons.org
which: no vim in                                    
+(/usr/local/bin::/usr/bin:/bin:/usr/games:/usr/X11R6/bin:/usr/local/games:/usr/
+sbin:/sbin:)                                                    
OpenSSH_3.0.2p1, SSH protocols 1.5/2.0, OpenSSL 0x0090603f
debug1: Reading configuration data /etc/ssh/ssh_config 
debug1: Seeding random number generator
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 0 geteuid 0 anon 1
debug1: Connecting to leapfrog.baltimorons.org [216.181.177.189] port 22.
debug1: temporarily_use_uid: 0/0 (e=0)
debug1: restore_uid           
debug1: temporarily_use_uid: 0/0 (e=0)
debug1: restore_uid       
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_3.0.2p1
debug1: match: OpenSSH_3.0.2p1 pat ^OpenSSH                                  
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.0.2p1                       
debug1: SSH2_MSG_KEXINIT sent                    
debug1: SSH2_MSG_KEXINIT received        
                                                                                
Program received signal SIGSEGV, Segmentation fault.
buffer_get (buffer=0x101e6be4,                                                  
    buf=0xbffff870 "\201i\005\b\214øÿ¿#g\005\bäk\036\020", len=4)
    at buffer.c:114                                       
114             if (len > buffer->end - buffer->offset)
(gdb) quit                             
The program is running.  Exit anyway? (y or n) y



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.