Crash after successful SSH password authentication before pty-req/shell request on macOS

[crmmc]

Crash after successful SSH password authentication before pty-req/shell request on macOS

Summary

WindTerm crashes every time when connecting to one specific SSH server. The same account and server work correctly with OpenSSH and FinalShell.

Server-side sshd -ddd logs show that password authentication and PAM session opening both succeed, and WindTerm opens an SSH session channel. However, WindTerm never sends pty-req or shell; it immediately sends EOF/close, then the macOS WindTerm process crashes.

This looks like a WindTerm client-side crash in the SSH session/shell creation path, not a server-side login failure.

Environment

• WindTerm version: 2.6.0
• OS: macOS 15.7.7
• WindTerm binary architecture: x86_64
• Hardware: Apple Silicon Mac running WindTerm under Rosetta
• Protocol: SSH
• Authentication: password auto-login
• Server: OpenSSH_9.2p1 Debian-2+deb12u9
• Server OS: Debian GNU/Linux, kernel 6.1.x amd64
• SSH port: custom port, reproducible on both the normal port and a temporary debug sshd -ddd port

Expected Behavior

After password authentication succeeds, WindTerm should request a PTY and shell, then open the terminal session normally.

Actual Behavior

WindTerm crashes after SSH authentication succeeds, before sending pty-req or shell to the server.

Other SSH clients can connect to the same server/account successfully:

• OpenSSH client: works
• FinalShell: works

Reproduction Steps

1. Create a new SSH session in WindTerm.
2. Use password authentication / auto-login.
3. Connect to the affected OpenSSH server.
4. Authentication succeeds on the server side.
5. WindTerm closes the SSH channel before requesting PTY/shell and then crashes.

The issue still reproduces after deleting the WindTerm session entry and recreating it from scratch.

Server-side Debug Evidence

I started a temporary debug sshd on another port:

sudo mkdir -p /run/sshd
sudo /usr/sbin/sshd -D -ddd -f /etc/ssh/sshd_config -p 22222 -E /tmp/sshd-windterm-debug.log

Then I connected to that temporary debug port from WindTerm. The relevant server-side log sequence is:

PAM: password authentication accepted
Accepted password for <user> from <client-ip> port <client-port> ssh2
PAM: opening session
active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Entering interactive session for SSH2.
server_input_channel_open: ctype session rchan 43 win 64000 max 261120
input_session_request
channel 0: new session [server-session]
session_new: session 0
session_open: channel 0
server_input_channel_open: confirm session
channel 0: rcvd eof
channel 0: rcvd close
session_close_by_channel: channel 0 child 0
Close session: user <user> from <client-ip> port <client-port> id 0
Connection closed by <client-ip> port <client-port>
PAM: closing session

Important point: there is no pty-req, no shell, and no exec request in the server log. The client closes the channel immediately after the server confirms the SSH session channel.

macOS Crash Report Stack

The macOS crash report consistently shows an EXC_BAD_ACCESS / segmentation fault in the WindTerm SSH shell/session creation path. The relevant stack frames are:

QtSharedPointer::ExternalRefCountData::getAndRef(QObject const*)
SuperSession::createTerm
SuperCommander::createMainTerm
SuperSession::onSshShellCreated
SshBridge::shellCreated
SshBridge::createShell::$_19::operator()
SshOperator::abort
SshOperator::onComplete
QTimer::timerEvent

The crash happens after the TCP connection and SSH authentication have already succeeded.

Additional Observations

• The same server/account works with OpenSSH and FinalShell.
• Recreating the WindTerm session from scratch does not help.
• Disabling public-key authentication and GSSAPI in the WindTerm session config does not help.
• A known-good server with the same OpenSSH server version works in WindTerm.
• Another WindTerm session with almost identical non-sensitive session settings works.
• The affected server advertises publickey,password, but other working servers also advertise public-key authentication, so this does not appear to be only a public-key advertisement issue.
• The crash is reproducible on both the normal sshd port and a temporary sshd -ddd debug port.

Why this appears client-side

The server accepts the password, opens the PAM session, enters interactive SSH mode, and confirms the SSH session channel. WindTerm then closes the channel before requesting PTY or shell. Since OpenSSH and FinalShell work against the same server/account, this looks like a WindTerm-specific failure in the post-auth SSH session/shell creation flow.

Please let me know if you need the full anonymized macOS .ips crash report or the full anonymized sshd -ddd log.

i had try 2.7.0 ,it show like 2.6.0 ,it exit suddently