kingToolbox / kingToolbox/WindTerm

Crash in Ssh::Session::setUser during keyboard-interactive SSH authentication on macOS

Open
#3,607 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
32.3k
Forks
2.5k
PR merge metrics
No merged PRs in 30d

Description

## Crash during SSH keyboard-interactive authentication on macOS Apple Silicon via Rosetta

### Summary

WindTerm crashes shortly after launch while performing SSH interactive authentication. The crash happens in a background `QThread`, inside `Ssh::Session::setUser(QByteArray const&)`, apparently while `Ssh::Session::authInteractive(...)` is being executed.

The crash looks like a null pointer dereference / invalid session object access during SSH authentication.

### Environment

- App: WindTerm
- Bundle ID: `KingToolbox.WindTerm`
- macOS: `macOS 26.3.1 (25D771280a)`
- Hardware: `Mac17,2`
- CPU/App architecture: `X86-64 (Translated)` via Rosetta
- Graphics: Apple M5
- Qt: 5.15.2, bundled with WindTerm
- libssh: bundled `libssh.4.dylib`
- OpenSSL: bundled `libcrypto.1.1.dylib`

### Crash Details

```text
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000008
Termination Reason: Namespace SIGNAL, Code 11, Segmentation fault: 11
Triggered by Thread: 20 QThread
```
### Faulting thread:
``text
Thread 20 Crashed:: QThread
0 WindTerm Ssh::Session::setUser(QByteArray const&) + 7
1 WindTerm Ssh::Session::authInteractive(QByteArray const&) + 14
2 WindTerm std::__1::__function::__func::operator()() + 63
3 WindTerm SshOperator::execute() + 244
4 QtCore void doActivate(QObject*, int, void**) + 1157
5 QtCore QTimer::timerEvent(QTimerEvent*) + 98
6 QtCore QObject::event(QEvent*) + 111
...
### Relevant register state:

rax: 0x0000000000000000
rdi: 0x0000000000000000
rip: 0x0000000102f51ff7
The invalid access address is 0x8, and rdi is 0x0, which suggests that Ssh::Session::setUser() may be called with a null this pointer or an invalid/cleared session object.

### Observed Behavior
WindTerm launches, then crashes around 10-12 seconds later, likely while restoring or starting an SSH connection.

### Expected Behavior
WindTerm should not crash during SSH authentication. If the session/user/configuration is invalid, it should report an authentication or configuration error instead of dereferencing a null pointer.

### Possible Trigger
This appears to happen during SSH keyboard-interactive authentication:
Ssh::Session::authInteractive(QByteArray const&)
SshBridge::authInteractive(...)

Possible related conditions:
SSH server requires keyboard-interactive authentication
MFA/OTP/PAM challenge is enabled
Saved session has an empty or invalid username
WindTerm restores a previous SSH session on launch
SSH session is cancelled/disconnected while the authentication task is still running
### Notes
The app is running as an Intel/x86_64 binary through Rosetta on Apple Silicon:
Code Type: X86-64 (Translated)
translated: true
This may be a compatibility factor, but the direct crash location is in WindTerm’s SSH authentication/session handling code.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing Ssh::Session::authInteractive() into Ssh::Session::setUser(), then follow the SshBridge::authInteractive() and SshOperator::execute() call chain. Reproduce keyboard-interactive authentication with a restored or cancelled SSH session on macOS; done means authentication reports an error or cancellation without crashing.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, macos
Domain
authentication, desktop, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.