Call for testing: OpenSSH 7.8

[Zev Weiss]

On Thu, Aug 09, 2018 at 08:16:34PM CDT, Damien Miller wrote:
>Hi,
>
>OpenSSH 7.8p1 is almost ready for release, so we would appreciate testing
>on as many platforms and systems as possible. This is a bugfix release.
>
>Snapshot releases for portable OpenSSH are available from
>http://www.mindrot.org/openssh_snap/
>
>The OpenBSD version is available in CVS HEAD:
>http://www.openbsd.org/anoncvs.html
>
>Portable OpenSSH is also available via git using the
>instructions at http://www.openssh.com/portable.html#cvs
>At https://anongit.mindrot.org/openssh.git/ or via a mirror at Github:
>https://github.com/openssh/openssh-portable
>
>Running the regression tests supplied with Portable OpenSSH does not
>require installation and is a simply:
>
>$ ./configure && make tests
>
>Live testing on suitable non-production systems is also appreciated.
>Please send reports of success or failure to
>openssh-unix-dev at mindrot.org. Security bugs should be reported
>directly to openssh at openssh.com.
>

On Void Linux (kernel 4.14, glibc 2.26, gcc 7.3) I'm seeing a failure in 
the test_kex unit test:

    $ git rev-parse HEAD
    e1b26ce504662a5d5b991091228984ccfd25f280
    $ ./configure --with-pam --with-pie --with-sandbox=seccomp_filter
    <...snip...>
    $ make tests
    <...snip...>
    test_kex: ....
    regress/unittests/kex/test_kex.c:76 test #5 "kex"
    ASSERT_INT_EQ(server->kex->done, 1) failed:
    server->kex->done = -649425904
               1 = 1
    Aborted
    make[1]: *** [Makefile:225: unit] Error 134
    make[1]: *** Waiting for unfinished jobs....

Manually invoking regress/unittests/kex/test_kex, I see the value 
printed for server->kex->done changing from one run to the next, which 
made me suspect some sort of memory corruption or lack of 
initialization, but running under valgrind doesn't show anything of the 
sort:

    $ valgrind ./regress/unittests/kex/test_kex 
    ==12365== Memcheck, a memory error detector
    ==12365== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
    ==12365== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
    ==12365== Command: ./regress/unittests/kex/test_kex
    ==12365== 
    test_kex: ....
    regress/unittests/kex/test_kex.c:76 test #5 "kex"
    ASSERT_INT_EQ(server->kex->done, 1) failed:
    server->kex->done = 103646864
               1 = 1
    ==12365== 
    ==12365== Process terminating with default action of signal 6 (SIGABRT)
    ==12365==    at 0x5CAF920: raise (raise.c:51)
    ==12365==    by 0x5CB0FFC: abort (abort.c:90)
    ==12365==    by 0x10E33E: test_die (test_helper.c:302)
    ==12365==    by 0x10FDD3: assert_int (test_helper.c:431)
    ==12365==    by 0x10E9C6: run_kex (test_kex.c:76)
    ==12365==    by 0x10ED27: do_kex_with_key (test_kex.c:117)
    ==12365==    by 0x10F1CF: do_kex (test_kex.c:181)
    ==12365==    by 0x10F21F: kex_tests (test_kex.c:192)
    ==12365==    by 0x10E65D: main (test_helper.c:162)
    ==12365== 
    ==12365== HEAP SUMMARY:
    ==12365==     in use at exit: 66,964 bytes in 1,732 blocks
    ==12365==   total heap usage: 2,350 allocs, 618 frees, 401,681 bytes allocated
    ==12365== 
    ==12365== LEAK SUMMARY:
    ==12365==    definitely lost: 0 bytes in 0 blocks
    ==12365==    indirectly lost: 0 bytes in 0 blocks
    ==12365==      possibly lost: 0 bytes in 0 blocks
    ==12365==    still reachable: 66,964 bytes in 1,732 blocks
    ==12365==         suppressed: 0 bytes in 0 blocks
    ==12365== Rerun with --leak-check=full to see details of leaked memory
    ==12365== 
    ==12365== For counts of detected and suppressed errors, rerun with: -v
    ==12365== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
    Aborted

Let me know if there's any additional information that would be 
useful...


Zev