SSH transport uses fixed-size argv array that may overflow with more options #60

New Issue

2026-07-20T17:14:08+02:00

TapTap commented

2026-07-20 17:14:08 +02:00

Description

In src/shared/transport_ssh.c line 105, the SSH argv array is fixed at 16 entries:

char* ssh_argv[16];

Currently 12 entries are used (including the NULL terminator), leaving only 4 spare slots. If additional SSH options are added (such as -o StrictHostKeyChecking=no, -o UserKnownHostsFile=/dev/null, or custom SSH config paths), the array will overflow, causing undefined behavior.

Additionally, on line 99, the ssh_user buffer is 512 bytes, but the combined user@host string could theoretically be up to 256 + 1 + 256 = 513 bytes (given the 256-byte buffers for user and host).

Location

src/shared/transport_ssh.c:99, 105

Suggested Fix

Either:

Dynamically allocate the argv array using a dynamically-sized array
Use a much larger fixed buffer (e.g., char* ssh_argv[32])
Switch to using execvpe() with a dynamically constructed argv

For the user buffer:

char ssh_user[1024];  // larger buffer

Severity

Low

Category

Quality

## Description In `src/shared/transport_ssh.c` line 105, the SSH argv array is fixed at 16 entries: ```c char* ssh_argv[16]; ``` Currently 12 entries are used (including the NULL terminator), leaving only 4 spare slots. If additional SSH options are added (such as `-o StrictHostKeyChecking=no`, `-o UserKnownHostsFile=/dev/null`, or custom SSH config paths), the array will overflow, causing undefined behavior. Additionally, on line 99, the ssh_user buffer is 512 bytes, but the combined user@host string could theoretically be up to `256 + 1 + 256 = 513` bytes (given the 256-byte buffers for user and host). ## Location `src/shared/transport_ssh.c:99, 105` ## Suggested Fix Either: 1. Dynamically allocate the argv array using a dynamically-sized array 2. Use a much larger fixed buffer (e.g., `char* ssh_argv[32]`) 3. Switch to using `execvpe()` with a dynamically constructed argv For the user buffer: ```c char ssh_user[1024]; // larger buffer ``` ## Severity Low ## Category Quality

TapTap referenced this issue from a commit

2026-07-20 18:44:11 +02:00

fix: memory/null safety bugs — issues #74, #72, #69, #64, #60, #50, #49, #65

TapTap closed this issue

2026-07-20 18:44:16 +02:00

TapTap referenced this issue

2026-07-20 18:44:16 +02:00

Fix memory/null safety bugs (#74, #72, #69, #64, #60, #50, #49, #65) #80

TapTap referenced this issue from a commit

2026-07-20 18:56:39 +02:00

fix: memory/null safety bugs — issues #74, #72, #69, #64, #60, #50, #49, #65

TapTap referenced this issue from a commit