openssh 4.6p1 closing connection with strange packet length

[fire-eyes]

Andreas Steinmetz wrote:
> server is running openssh 4.6p1 on linux x86 (32bit)
> client is running openssh 4.6p1 on linux x86_64 (64bit)
> 
> Just connecting from the client to the server and running "top" long
> enough results in:
> 
> Disconnecting: Bad packet length 3690378913.
> 
> This seems like a 32/64 bit problem to me.

I am getting similar results. What follows is a dirty cut-n-paste of the
issues I told gentoo's bugzilla about, I hope it is enough information
(I am short on time).

The client is 32 bit, the server is 64 bit. The server runs 4.6_p1.


I use ssh "4.7_p1" (gentooism?) to connect to my server, like so:

ssh -p someport -D localport -R
remoteIP:remotelistenPORT:localIP:localPORT username at remoteIP -C -2

On the server, a backup script which uses rsync runs. This script
connects to its local port remotelistenPORT from above. This is then
tunneled back over SSH and comes out to localIP and localPORT, to
connect to an rsync server.

This all worked fine prior to ssh "4.7_p1". After that, any time this
script runs at 40 minutes after every hour, my ssh session dies, and
apps that were using the tunnel get disconnected.

Here is the output I see:

Client side:

buffer_get_string_ret: bad string length 364172
buffer_get_string: buffer error


Server side:

Sep  5 11:40:06 thing sshd[23786]: fatal: buffer_append_space: len
1646878 not supported
Sep  5 11:40:06 thing sshd(pam_unix)[23786]: session closed for user myuser
Sep  5 11:40:06 thing sshd[23784]: syslogin_perform_logout: logout()
returned an error


I tried running my backup script manually and was able to reproduce.

Client side:

buffer_get_string_ret: bad string length 270072
buffer_get_string: buffer error


Server side:

Sep  5 11:43:41 thing sshd[24104]: fatal: buffer_append_space: len
1440384 not supported
Sep  5 11:43:41 thing sshd(pam_unix)[24104]: session closed for user myuser
Sep  5 11:43:41 thing sshd[24102]: syslogin_perform_logout: logout()
returned an error