github-vet / github-vet/rangeloop-pointer-findings

blacknon/lssh: ssh/pshell_executor.go; 72 LoC

Open
#18,096 0 comments 0 reactions 0 assignees View on GitHub
fresh medium
Dominant language
No language data
Stars
0
Forks
0
PR merge metrics
PR metrics pending

Description

Found a possible issue in [blacknon/lssh](https://www.github.com/blacknon/lssh) at [ssh/pshell_executor.go](https://github.com/blacknon/lssh/blob/c6b6645893746cfe5489082dc58f295f544384d4/ssh/pshell_executor.go#L50-L121)

Below is the message reported by the analyzer for this snippet of code. Beware that the analyzer only reports the first issue it finds, so please do not limit your consideration to the contents of the below message.

> range-loop variable pline used in defer or goroutine at line 111

[Click here to see the code in its original context.](https://github.com/blacknon/lssh/blob/c6b6645893746cfe5489082dc58f295f544384d4/ssh/pshell_executor.go#L50-L121)

Click here to show the 72 line(s) of Go which triggered the analyzer.

```go
for _, pline := range pslice {
// count pipe num
pnum := countPipeSet(pline, "|")

// create pipe set
pipes := createPipeSet(pnum)

// join pipe set
pline = joinPipeLine(pline)

// printout run command
fmt.Printf("[Command:%s ]\n", joinPipeLineSlice(pline))

// pipe counter
var n int

// create channel
ch := make(chan bool)
defer close(ch)

kill := make(chan bool)
defer close(kill)

for i, p := range pline {
// declare nextPipeLine
var bp pipeLine

// declare in,out
var in *io.PipeReader
var out *io.PipeWriter

// get next pipe line
if i > 0 {
bp = pline[i-1]
}

// set stdin
// If the before delimiter is a pipe, set the stdin before io.PipeReader.
if bp.Oprator == "|" {
in = pipes[n-1].in
}

// set stdout
// If the delimiter is a pipe, set the stdout output a io.PipeWriter.
if p.Oprator == "|" {
out = pipes[n].out

// add pipe num
n++
}

// exec pipeline
go ps.run(p, in, out, ch, kill)
}

// get and send kill
killExit := make(chan bool)
defer close(killExit)
go func() {
select {
case <-ps.Signal:
for i := 0; i < len(pline); i++ {
kill <- true
}
case <-killExit:
return
}
}()

// wait channel
ps.wait(len(pline), ch)
}

```

Leave a reaction on this issue to contribute to the project by classifying this instance as a **Bug** :-1:, **Mitigated** :+1:, or **Desirable Behavior** :rocket:
See the descriptions of the classifications [here](https://github.com/github-vet/rangeclosure-findings#how-can-i-help) for more information.

commit ID: c6b6645893746cfe5489082dc58f295f544384d4

Contributor guide

No contributing guide indexed for this repository

Research direction

Read ssh/pshell_executor.go around lines 50-121, focusing on the range variable pline and its uses in deferred functions and goroutines. Trace whether those uses can observe an unintended value, then classify the finding as Bug, Mitigated, or Desirable Behavior by leaving the corresponding reaction on the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.