#338325 ssh: client segv with gssapi

Package:
ssh
Source:
openssh
Description:
secure shell client and server (metapackage)
Submitter:
Dave Love
Date:
2026-08-23 11:43:02 UTC
Severity:
normal
#338325#5
Date:
2005-11-09 14:27:35 UTC
From:
To:
I get an unreproducible segv in the client with gssapi authentication
on (`GSSAPIAuthentication yes', `GSSAPIDelegateCredentials yes')
connecting to either Solaris 10 or Debian stable servers.  I haven't
noticed a crash without gssapi yet.  I assume there's an uninitialized
variable or similar; it might be in the library, but I can't tell and
don't have time to build and debug it currently.  I caught one crash:

Program received signal SIGSEGV, Segmentation fault.
0x700cf454 in bn_sub_words () from /usr/lib/v9/libcrypto.so.0.9.8
(gdb) bt
#0  0x700cf454 in bn_sub_words () from /usr/lib/v9/libcrypto.so.0.9.8
#1  0x700c8c20 in bn_sub_part_words () from /usr/lib/v9/libcrypto.so.0.9.8
#2  0x700c979c in bn_mul_recursive () from /usr/lib/v9/libcrypto.so.0.9.8
#3  0x700c964c in bn_mul_recursive () from /usr/lib/v9/libcrypto.so.0.9.8
#4  0x700ca50c in BN_mul () from /usr/lib/v9/libcrypto.so.0.9.8
#5  0x700d0a30 in BN_mod_mul_montgomery () from /usr/lib/v9/libcrypto.so.0.9.8
#6  0x700c6cf8 in BN_mod_exp_mont_consttime ()
   from /usr/lib/v9/libcrypto.so.0.9.8
#7  0x700ea4c4 in DH_OpenSSL () from /usr/lib/v9/libcrypto.so.0.9.8
#8  0x700ea28c in DH_generate_key () from /usr/lib/v9/libcrypto.so.0.9.8
#9  0x00039b4c in error ()
#10 0x00038930 in error ()
#11 0x00034314 in error ()
#12 0x00033ab4 in error ()
#13 0x0001ee6c in ?? ()
#14 0x0001ee6c in ?? ()
Previous frame identical to this frame (corrupt stack?)

Then another attempt worked.

Note that this is on SPARC.