Feat/build

[kooksee]

No description provided.

[gemini-code-assist]

Code Review

This pull request updates Dropbear to version 2026.91, introducing security fixes, RSA exponent blinding, a new Zig build system, and improved port and stream forwarding. The code review identified several critical issues: a missing NULL terminator in the multihop_args array that could cause crashes during execution or cleanup, an uninitialized entry->host pointer in permitlisten options that leads to crashes when freed, and a potential NULL pointer dereference in svr_remotestreamlocalreq during early exit. Additionally, compilation errors were found in the new build.zig file regarding incorrect std.ArrayList usage and invalid io arguments in directory operations. Finally, minor improvements were suggested to remove an unused variable in rsa.c and add a defensive NULL check in m_mp_burn.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The allocated args array in multihop_args is not NULL-terminated before being returned. Since execve expects a NULL-terminated array of arguments, and the cleanup loop in cli_proxy_cmd relies on a NULL sentinel to stop freeing elements, this will lead to out-of-bounds reads and crashes. Please ensure the array is explicitly NULL-terminated.

\t/* hostnames of prior hops */\n\targs[pos] = m_strdup(prior_hops);\n\tpos++;\n\n\targs[pos] = NULL;\n\treturn args;

[gemini-code-assist]

The entry->host pointer is never initialized to NULL when parsing permitlisten options. Since m_malloc does not zero-initialize memory, entry->host will contain garbage. When svr_pubkey_options_cleanup is called, it attempts to free entry->host, which will result in a crash due to freeing an uninitialized pointer. Please initialize entry->host to NULL.

\t\t\t\t\tstruct PermitTCPFwdEntry *entry =\n\t\t\t\t\t\t\t(struct PermitTCPFwdEntry*)m_malloc(sizeof(struct PermitTCPFwdEntry));\n\t\t\t\t\tentry->host = NULL;\n\n\t\t\t\t\tlist_append(pubkey_options->permit_listens, entry);

[gemini-code-assist]

If svr_remotestreamlocalreq exits early (for example, if a forced command is active), tcpinfo remains NULL. The out block unconditionally attempts to dereference tcpinfo->socket_path to free it, which will cause a NULL pointer dereference and crash the server. Please add a NULL check for tcpinfo before freeing its members.

out:\n    if (ret == DROPBEAR_FAILURE) {\n        /* we only free it if a listener wasn't created, since the listener\n         * has to remember it if it's to be cancelled */\n        m_free(request_path);\n        if (tcpinfo) {\n            m_free(tcpinfo->socket_path);\n            m_free(tcpinfo);\n        }\n    }

[gemini-code-assist]

The std.ArrayList type is used with .empty and has b.allocator passed to its appendSlice calls. In Zig, std.ArrayList is a managed list whose methods do not accept an allocator. You should use std.ArrayListUnmanaged instead, which is designed to be initialized with .empty and accepts an allocator for its operations. This applies to lines 36, 66, 88, 240, and 286.

    var common_flags: std.ArrayListUnmanaged([]const u8) = .empty;

[gemini-code-assist]

The standard library std.fs.Dir.openDir does not accept an io parameter. Similarly, walker.next() and it.next() do not accept io as an argument. Passing io to these functions will cause a compilation error. Please remove the io argument from these calls (lines 241, 249, and 260).

    var dir = b.build_root.handle.openDir(sub, .{ .iterate = true }) catch |err| {

[gemini-code-assist]

The variable rsa_b_phi is initialized in m_mp_init_multi but is never used in any calculations. It should be removed to clean up the code. Remember to also remove it from m_mp_burn and mp_clear_multi calls later in the function.

\tDEF_MP_INT(rsa_b_d);\n\t\n\tTRACE((\"enter buf_put_rsa_sign\"))\n\tdropbear_assert(key != NULL);\n\n\tm_mp_init_multi(&rsa_s, &rsa_tmp1, &rsa_tmp2, &rsa_tmp3,\n\t\t&rsa_phi_n, &rsa_b_tmp, &rsa_b_rand, &rsa_b_d,\n\t\tNULL);

[gemini-code-assist]

To prevent potential undefined behavior or crashes when m_mp_burn is called on an uninitialized or already cleared mp_int (where mp->dp is NULL), it is safer to add a defensive NULL check before calling m_burn.

void m_mp_burn(mp_int *mp) {\n\tif (mp->dp) {\n\t\tm_burn(mp->dp, mp->alloc * sizeof(*mp->dp));\n\t}\n\tmp->used = 0;\n}