Hi,

I found a bug at "pty.c" during ssh server implementation.

When I turn on CONFIG_SERIAL_TERMIOS and OPOST|ONLCR on pty device
for nsh console's stdin/stdout (ssh shell service), I've got system crash.

Bugs at line 687 of pty.c, pty_write()
ntotal++;

when converting '\n' to '\r\n', pty_write() will return more than requested
(+1, for example) length. and this will break caller lib_fflush(), line 150
of lib_libfflush.c.
When she get (libfflush()) bytes_nwritten which is greater than nbuffer,
nbuffer goes to negative at line 150 and eventually destroys
*stream->fs_bufpos at line 163 of lib_libflush.c

Removing ntotal++;  line 687 of pty.c will fix this bug.

BTW, nsh using ptm/pty as a ssh shell service works great with libssh +
mbedtls.

Thanks

kwo...@kmd.co.kr

Reply via email to