Is this a bug in 5.4p1?

[Damien Miller]

On Fri, 12 Mar 2010, JCA wrote:

>    I am testing with a 5.4p1 client and have noticed, on the server
> side, that sometimes an SSH_MSG_DISCONNECT message is received with
> the following 28-byte long payload:
> 
> 0x00    0x00    0x00    0x0b
>                    Reason: SSH_DISCONNECT_BY_APPLICATION
> 0x00   0x00     0x00    0x14
>                    Description string length: 20 bytes
> 0x64    0x69    0x73    0x63    0x6f   0x6e   0x6e    0x65
>  Description string: disconnected by user
> 0x63    0x74    0x65    0x64    0x20  0x62   0x79    0x20
> 0x75    0x73    0x65    0x72
> 
> Is this not incomplete?

Yes, this is a bug. Here's a patch:

Index: clientloop.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/clientloop.c,v
retrieving revision 1.218
diff -u -p -r1.218 clientloop.c
--- clientloop.c	28 Jan 2010 00:21:18 -0000	1.218
+++ clientloop.c	12 Mar 2010 20:22:14 -0000
@@ -1472,6 +1472,7 @@ client_loop(int have_pty, int escape_cha
 		packet_start(SSH2_MSG_DISCONNECT);
 		packet_put_int(SSH2_DISCONNECT_BY_APPLICATION);
 		packet_put_cstring("disconnected by user");
+		packet_put_cstring(""); /* language tag */
 		packet_send();
 		packet_write_wait();
 	}