Bug 324181

Description of problem:

I'm running openssh-server, with no unusual configuration parameters.  Every
time a client connects, the server crashes with a segfault after receiving a
password from the client.

Version-Release number of selected component (if applicable):

openssh-server-4.5p1-6.fc7.x86_64

How reproducible:

100%

Steps to Reproduce:
1. service sshd start
2. try to connect from a remote host
3. crash!

Actual results:

I tried removing and reinstalling openssh-server, with no luck.  I also
generated a new set of host keys, again with no luck.

Even with a debuginfo RPM installed, I get meaningless backtraces:

(gdb) run -de
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/sbin/sshd -de
debug1: sshd version OpenSSH_4.5p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-de'
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Bind to port 22 on 0.0.0.0.
Bind to port 22 on 0.0.0.0 failed: Address already in use.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 4 out 4 newsock 4 pipe -1 sock 7
debug1: sshd version OpenSSH_4.5p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: inetd sockets after dupping: 3, 3
Connection from 127.0.0.1 port 47770
debug1: Client protocol version 2.0; client software version OpenSSH_4.7
debug1: match: OpenSSH_4.7 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.5
[Detaching after fork from child process 11132.]
debug1: permanently_set_uid: 74/74
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user bos service ssh-connection method none
debug1: attempt 0 failures 0
debug1: PAM: initializing for "bos"
debug1: PAM: setting PAM_RHOST to "tachylite.serpentine.com"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user bos service ssh-connection method password
debug1: attempt 1 failures 1
[New LWP 11140]

Program received signal SIGSEGV, Segmentation fault.
[Switching to LWP 11140]
0x00005555557e11b0 in ?? ()
(gdb) bt
#0  0x00005555557e11b0 in ?? ()
#1  0x00002aaaadd854f6 in ?? ()
#2  0x0000000000010000 in ?? ()
#3  0x0000555500000000 in ?? ()
#4  0x281450006f616943 in ?? ()
#5  0x0001200000000011 in ?? ()
#6  0x00000000000c0000 in ?? ()
#7  0x42a501698b000000 in ?? ()
#8  0xb2360f35aa5c11e9 in ?? ()
#9  0x00000335f88c1dd9 in ?? ()
#10 0x50416f4d08660000 in ?? ()
#11 0x0000620001083952 in ?? ()
#12 0x003201f40064000a in ?? ()
#13 0x0000000010000000 in ?? ()
#14 0x66d6000800000000 in ?? ()
#15 0x0000000001640000 in ?? ()
#16 0x0000000000000000 in ?? ()