sftp broken?

[Dag-Erling Smørgrav]

Xin LI <delphij at delphij.net> writes:
> The backtrace shows that the access violation happen inside libc
> (glob*) but I have not yet got a clue why this would ever happen.

It's trying to dereference a NULL function pointer:

(gdb) frame 1
#1  0x0000000800ef9920 in glob2 (pathbuf=0x7fffffff5660, 
    pathend=0x7fffffff56a8, pathend_last=0x7fffffff7658, 
    pattern=0x7fffffff76a8, pglob=0x7fffffffd8d0, limit=0x7fffffffd720)
    at /usr/src/lib/libc/gen/glob.c:844
844			return((*pglob->gl_lstat)(buf, sb));
(gdb) p pglob
$1 = (glob_t *) 0x7fffffffd8d0
(gdb) p *pglob
$2 = {gl_pathc = 0, gl_matchc = 0, gl_offs = 0, gl_flags = 216, 
  gl_pathv = 0x0, gl_errfunc = 0, gl_closedir = 0x408bfb <fudge_opendir>, 
  gl_readdir = 0x408b50 <fudge_lstat>, gl_opendir = 0x408b20 <fudge_stat>, 
  gl_lstat = 0, gl_stat = 0x7fffffffda00}

The problem is that OpenSSH wants to use its own version of glob(3), but
we don't compile it or link it in, so it calls ours with a struct pglob
that has the wrong layout.  The attached patch should fix that, I will
commit it when I've tested it more thoroughly.

DES
-- 
Dag-Erling Smørgrav - des at des.no

-------------- next part --------------
A non-text attachment was scrubbed...
Name: openssh-glob.diff
Type: text/x-patch
Size: 1012 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20091014/2f5a0b6f/openssh-glob.bin