Mailing List Archive

[Bug 1528] sshd hangs when pasting more than 2k of text
https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #1 from Doke Scott <doke@udel.edu> 2008-10-02 08:02:30 ---
Created an attachment (id=1571)
--> (http://bugzilla.mindrot.org/attachment.cgi?id=1571)
alternate patch for channels.c

The ioctl is failing partially because the wfd file descriptor isn't
actually a pty. It's being incorrectly flagged as one in
channel_register_fds() which simply trusts it's caller. Also the test
on line 1605 is checking to see if rfd is a pty, before applying the
ioctl to wfd.

So this will also fix the problem, but might not be as secure because
it doesn't send the ignored random data packets.

--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
[Bug 1528] sshd hangs when pasting more than 2k of text [ In reply to ]
https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #2 from Darren Tucker <dtucker@zip.com.au> 2008-10-02 11:15:13 ---
Created an attachment (id=1572)
--> (http://bugzilla.mindrot.org/attachment.cgi?id=1572)
Only generate fake echo packets for tty writes < 1k

I suspect patch #1570 would make the echo/noecho difference observable
on the wire. An alternative is to only do this check for small writes.

--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
[Bug 1528] sshd hangs when pasting more than 2k of text [ In reply to ]
https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #3 from Doke Scott <doke@udel.edu> 2008-10-11 07:35:12 ---
I'm not sure 1572 will avoid the problem. Large writes get broken up
into multiple writes. The last one can be small, yet enough to fill
the pipe, and make the ioctl hang.

--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
[Bug 1528] sshd hangs when pasting more than 2k of text [ In reply to ]
https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #4 from Doke Scott <doke@udel.edu> 2008-10-11 07:39:24 ---
1571 avoids the problem, but makes it more vulnerable to analysis.
Maybe it could randomly decide to send random size fake packets?

--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs