Fixed 512-byte stack buffer for SSH user@host can truncate silently #115

New Issue

2026-07-21T16:20:42+02:00

TapTap commented

2026-07-21 16:20:42 +02:00

Description

char ssh_user[512] in transport_ssh.c:121 is used with snprintf for user@host. The code checks needed >= sizeof(ssh_user) and prints a warning but continues execution with a truncated string. The execvp("ssh", ...) call will use the truncated user@host, potentially connecting to the wrong host or user, or failing mysteriously.

Location

src/shared/transport_ssh.c:121-128

How to trigger

Specify a very long username or hostname in the SSH destination (e.g., user@very.long.hostname.that.exceeds.512.bytes.example.com:/path). The local buffer truncates the string silently.

Suggested Fix

Use dynamically allocated buffer with asprintf() or malloc() + snprintf() instead of the fixed 512-byte stack buffer. Fail with an error message on truncation rather than continuing with truncated data.

Severity

medium

Sub-Agent

security-screener (SC-4)

This issue was automatically generated by the issue-creator agent.

## Description `char ssh_user[512]` in `transport_ssh.c:121` is used with `snprintf` for `user@host`. The code checks `needed >= sizeof(ssh_user)` and prints a warning but continues execution with a truncated string. The `execvp("ssh", ...)` call will use the truncated user@host, potentially connecting to the wrong host or user, or failing mysteriously. ## Location src/shared/transport_ssh.c:121-128 ## How to trigger Specify a very long username or hostname in the SSH destination (e.g., `user@very.long.hostname.that.exceeds.512.bytes.example.com:/path`). The local buffer truncates the string silently. ## Suggested Fix Use dynamically allocated buffer with `asprintf()` or `malloc()` + `snprintf()` instead of the fixed 512-byte stack buffer. Fail with an error message on truncation rather than continuing with truncated data. ## Severity medium ## Category security ## Sub-Agent security-screener (SC-4) --- _This issue was automatically generated by the issue-creator agent._

TapTap referenced this issue

2026-07-21 16:48:29 +02:00

Security hardening: path traversal, TLS verification, DOS protections (#112-#118) #138

TapTap closed this issue

2026-07-29 18:27:14 +02:00

TapTap commented

2026-07-29 18:27:32 +02:00