openssh-3.7.1p1 segfaults

[Darren Tucker]

Martin Siegert wrote:
> the following problem occurs on Solaris 2.6. openssh-3.7p1 and openssh-3.7.1p1
> both show the same behaviour.

I've had a closer look at the debugging here (pretty good info, BTW). 
Your gdb+backtrace doesn't capture the problem, however, since the
backtrace is from the privileged process and the SEGV appears to be
occurring in the unprivileged child.

Can you try:
1) Reproducing the problem with "UsePrivilegeSeparation=no".
If it happens with privsep=no, use gdb to get a backtrace and post it.

2) If it doesn't happend with privsep, you need to try and debug the
child, which can be tricky.  I suggest setting a breakpoint for sshd.c:650
(just before the fork), then set "set follow-fork child", then continue. 
Hopefully this will catch it so you can do a backtrace.

I also suggest that if you haven't already, open a bug at
bugzilla.mindrot.org (check for dupes first) as this looks like it might
take a bit of work and it's easier to track if it's in bugzilla.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.