Subject: SIGSEGV in packet.c

SIGSEGV in packet.c

From: suyog jadhav <>
Date: Fri, 19 Mar 2010 12:17:40 +0530 (IST)

Hi All, I am posting for first time ,so don't know how to go about this. I found a bug in code which results in SIGSEGV in my application for a particular condition. Debugging revealed the culprit to be in packet.c, case SSH_MSG_CHANNEL_WINDOW_ADJUST: { unsigned long bytestoadd = _libssh2_ntohu32(data + 5); session->packAdd_channel = _libssh2_channel_locate(session,_libssh2_ntohu32(data + 1)); if (session->packAdd_channel && bytestoadd) { session->packAdd_channel->local.window_size += bytestoadd; } _libssh2_debug(session, LIBSSH2_TRACE_CONN, "Window adjust received for channel %lu/%lu, adding %lu bytes, new window_size=%lu", session->packAdd_channel->, session->packAdd_channel->, bytestoadd, session->packAdd_channel->local.window_size); LIBSSH2_FREE(session, data); session->packAdd_state = libssh2_NB_state_idle; return 0; } if _libssh2_channel_locate returns NULL to session->packAdd_channel, and then if it is accessed in _libssh2_debug and it segfaults, so the _libssh2_debug call should be inside the preceding IF block. I understand the underlying cause has to be researched more i.e. why is SSH_MSG_CHANNEL_WINDOW_ADJUST received for non-existent channel, but the above check has to be done for correctness any way.any ideas? Kindly let me know how this change can be added in libssh2? Regards Suyog Jadhav The INTERNET now has a personality. YOURS! See your Yahoo! Homepage.

Received on 2010-03-19