Rob Elmes - 4 days ago

sshpass 1.10 segfaults when -e is used while the selected environment variable is unset.

This is a regression of patch #2, which was marked fixed in 2008 and documented in the 1.04 ChangeLog:
https://sourceforge.net/p/sshpass/patches/2/

Steps to reproduce

env -u SSHPASS ./sshpass -e true

Expected result

sshpass: -e option given but "SSHPASS" environment variable is not set.
Use "sshpass -h" to get help

The process should exit with RETURN_INVALID_ARGUMENTS (status 1).

Actual result

Segmentation fault (core dumped)

The same failure occurs with an explicitly named missing variable:

env -u TEST_SSHPASS ./sshpass -eTEST_SSHPASS true

Cause

In main.c, case 'e' detects getenv(optarg) returning NULL and sets error=RETURN_INVALID_ARGUMENTS, but execution then continues into hide_password(). hide_password() calls strdup(args.orig_password), resulting in strdup(NULL) and SIGSEGV.

The observed stack was:

#0 libc string routine
#1 strdup
#2 hide_password
#3 main

The core registers confirmed that the argument passed to strdup was NULL.

Proposed fix

The attached patch breaks out of the option switch immediately after recording the invalid argument, preventing hide_password() and unsetenv() from running on the missing value.

Verification against the 1.10 release source

  • missing SSHPASS: diagnostic and exit status 1
  • missing explicitly named variable (-eTEST_SSHPASS): diagnostic and exit status 1
  • defined SSHPASS with a command that does not prompt: exit status 0

Patch prepared with GitHub Copilot CLI, powered by GPT-5.6 Sol.