Call for testing: openssh-9.8

[Björn Lässig]

Hi,

This is my first post here, I'm trying my best. I am admin and not a
developer but as such I am heavily dependent on openssh.

On Tue, 2024-06-18 at 12:46 +1000, Damien Miller wrote:
> OpenSSH 9.8p1 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This is a bugfix release.
> 

While all tests on my host were OK ("all tests passed"),
I get a number of compile warnings, e.g:

ssh-keygen.c: In function ‘do_gen_all_hostkeys’:
ssh-keygen.c:1133:55: warning: ‘%s’ directive output may be truncated writing up to 1024 bytes into a region of size 1023 [-Wformat-truncation=]
 1133 |                 snprintf(comment, sizeof comment, "%s@%s", pw->pw_name,
      |                                                       ^~
 1134 |                     hostname);
      |                     ~~~~~~~~                           
In function ‘snprintf’,
    inlined from ‘do_gen_all_hostkeys’ at ssh-keygen.c:1133:3:


Is it worth it to fix this?
I asked a helpful friend (thanks Uwe) and he suggests something like:

diff --git a/ssh-keygen.c b/ssh-keygen.c
index 97c6d134a16f..69431bbc3084 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -3385,6 +3385,12 @@ main(int argc, char **argv)
 	pw = pwcopy(pw);
 	if (gethostname(hostname, sizeof(hostname)) == -1)
 		fatal("gethostname: %s", strerror(errno));
+	/*
+	 * According to POSIX hostname might have been trunctated without
+	 * returning an error and that in this case it's unspecified if hostname
+	 * is terminated by a null byte.
+	 */
+	hostname[sizeof(hostname) - 1] = '\0';
 
 	sk_provider = getenv("SSH_SK_PROVIDER");
 
@@ -3918,7 +3924,8 @@ main(int argc, char **argv)
 		strlcpy(comment, identity_comment, sizeof(comment));
 	} else {
 		/* Create default comment field for the passphrase. */
-		snprintf(comment, sizeof comment, "%s@%s", pw->pw_name, hostname);
+		if (snprintf(comment, sizeof comment, "%s@%s", pw->pw_name, hostname) >= sizeof comment)
+			comment[sizeof comment - 1] = '\0';
 	}
 
 	/* Save the key with the given passphrase and comment. */

Have a nice day
Björn Lässig