Commands longer than 249 characters fail silently

[bradmoody]

Running this command

ssh <hostname> "echo -------------20--------30--------40--------50--------60--------70--------80--------90-------100-------110-------120-------130-------140-------150-------160-------170-------180-------190-------200-------210-------220-------230-------240-------2"

works as expected.

Running

ssh <hostname> "echo -------------20--------30--------40--------50--------60--------70--------80--------90-------100-------110-------120-------130-------140-------150-------160-------170-------180-------190-------200-------210-------220-------230-------240-------25"

produces no output.

The host is a Windows 7 machine running Win32-OpenSSH v0.0.7.0.

The client is an Ubuntu 14.04 machine.

ssh -V
OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8, OpenSSL 1.0.1f 6 Jan 2014

I've also reproduced it from other clients.

[bradmoody]

Also reproduced now on v0.0.6.0. On this version the first command exits with status 0 and the second exits with status 23. This isn't observed on v0.0.7.0 because of another bug that causes all ssh commands to exit with status 4.

[zbordas]

We ran into this very same issue. I tracked down the problem and there is a bug in the shell-host utility that will limit the entire execution command line to 260 characters.

If you open the shell-host.c file around line 1010:

int start_with_pty(int ac, wchar_t **av) {
STARTUPINFO si;
PROCESS_INFORMATION pi;
wchar_t cmd[MAX_CMD_LEN];

… and also around line 1152:

int start_withno_pty(int ac, wchar_t **av) {
STARTUPINFO si;
PROCESS_INFORMATION pi;
wchar_t cmd[MAX_CMD_LEN];
SECURITY_ATTRIBUTES sa;
BOOL ret;

However, later this buffer will be handled as it was only MAX_PATH long:

cmd[0] = L'\0';
if (ac)
GOTO_CLEANUP_ON_ERR(wcscat_s(cmd, MAX_PATH, L"cmd.exe"));

ac--;
av++;
if (ac)
    GOTO_CLEANUP_ON_ERR(wcscat_s(cmd, MAX_PATH, L" /c"));
while (ac) {
    GOTO_CLEANUP_ON_ERR(wcscat_s(cmd, MAX_PATH, L" "));
    GOTO_CLEANUP_ON_ERR(wcscat_s(cmd, MAX_PATH, *av));
    ac--;
    av++;
}

All these MAX_PATH references should be MAX_CMD_LEN:

cmd[0] = L'\0';
if (ac)
GOTO_CLEANUP_ON_ERR(wcscat_s(cmd, MAX_CMD_LEN, L"cmd.exe"));

ac--;
av++;
if (ac)
    GOTO_CLEANUP_ON_ERR(wcscat_s(cmd, MAX_CMD_LEN, L" /c"));
while (ac) {
    GOTO_CLEANUP_ON_ERR(wcscat_s(cmd, MAX_CMD_LEN, L" "));
    GOTO_CLEANUP_ON_ERR(wcscat_s(cmd, MAX_CMD_LEN, *av));
    ac--;
    av++;
}

There are 2 places in the code having this problem. If you replace those with the suggested lines it all works without problems.

I see that this utility has been provided my Microsoft so I am not sure if this forum the right place to report it or not. I will try to report it back to the original author. In the meantime I hope it will be fixed in the original OpenSSH baseline very soon.

[manojampalam]

Thanks for finding the issue in code. Fix should be available in Jan-End drop.