kingToolbox / kingToolbox/WindTerm
Crash in Ssh::Session::setUser during keyboard-interactive SSH authentication on macOS
- Dominant language
- C
- Stars
- 32.3k
- Forks
- 2.5k
- PR merge metrics
- No merged PRs in 30d
Description
## Crash during SSH keyboard-interactive authentication on macOS Apple Silicon via Rosetta
### Summary
WindTerm crashes shortly after launch while performing SSH interactive authentication. The crash happens in a background `QThread`, inside `Ssh::Session::setUser(QByteArray const&)`, apparently while `Ssh::Session::authInteractive(...)` is being executed.
The crash looks like a null pointer dereference / invalid session object access during SSH authentication.
### Environment
- App: WindTerm
- Bundle ID: `KingToolbox.WindTerm`
- macOS: `macOS 26.3.1 (25D771280a)`
- Hardware: `Mac17,2`
- CPU/App architecture: `X86-64 (Translated)` via Rosetta
- Graphics: Apple M5
- Qt: 5.15.2, bundled with WindTerm
- libssh: bundled `libssh.4.dylib`
- OpenSSL: bundled `libcrypto.1.1.dylib`
### Crash Details
```text
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000008
Termination Reason: Namespace SIGNAL, Code 11, Segmentation fault: 11
Triggered by Thread: 20 QThread
```
### Faulting thread:
``text
Thread 20 Crashed:: QThread
0 WindTerm Ssh::Session::setUser(QByteArray const&) + 7
1 WindTerm Ssh::Session::authInteractive(QByteArray const&) + 14
2 WindTerm std::__1::__function::__func::operator()() + 63
3 WindTerm SshOperator::execute() + 244
4 QtCore void doActivate(QObject*, int, void**) + 1157
5 QtCore QTimer::timerEvent(QTimerEvent*) + 98
6 QtCore QObject::event(QEvent*) + 111
...
### Relevant register state:
rax: 0x0000000000000000
rdi: 0x0000000000000000
rip: 0x0000000102f51ff7
The invalid access address is 0x8, and rdi is 0x0, which suggests that Ssh::Session::setUser() may be called with a null this pointer or an invalid/cleared session object.
### Observed Behavior
WindTerm launches, then crashes around 10-12 seconds later, likely while restoring or starting an SSH connection.
### Expected Behavior
WindTerm should not crash during SSH authentication. If the session/user/configuration is invalid, it should report an authentication or configuration error instead of dereferencing a null pointer.
### Possible Trigger
This appears to happen during SSH keyboard-interactive authentication:
Ssh::Session::authInteractive(QByteArray const&)
SshBridge::authInteractive(...)
Possible related conditions:
SSH server requires keyboard-interactive authentication
MFA/OTP/PAM challenge is enabled
Saved session has an empty or invalid username
WindTerm restores a previous SSH session on launch
SSH session is cancelled/disconnected while the authentication task is still running
### Notes
The app is running as an Intel/x86_64 binary through Rosetta on Apple Silicon:
Code Type: X86-64 (Translated)
translated: true
This may be a compatibility factor, but the direct crash location is in WindTerm’s SSH authentication/session handling code.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing Ssh::Session::authInteractive() into Ssh::Session::setUser(), then follow the SshBridge::authInteractive() and SshOperator::execute() call chain. Reproduce keyboard-interactive authentication with a restored or cancelled SSH session on macOS; done means authentication reports an error or cancellation without crashing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, macos
- Domain
- authentication, desktop, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100