wolfSSH_stream_read consumes before crediting and always reports the byte count.

[yosuke-wolfssl]

Problem

ssh_worker() in the echo server treats every positive write(), send(), and
wolfSSH_ChannelIdSend() return as a complete transfer. SendChannelData() clamps
each send to min(peerWindowSz, peerMaxPacketSz, maxPacketSz) and returns that
clamped count, so a send larger than the peer's window returns short. Every call
site then overwrites or discards its source buffer — the forwarding path resets
fwdBufferIdx to 0 on any positive result — and the unsent suffix is lost
silently. Reachable through the shell, agent, and forwarding paths.

Separately, wolfSSH_stream_read() credits inputBuffer->idx bytes but advanced
idx only afterwards, so a read never credits its own bytes. A single read that
drains the entire receive window leaves the window at zero with nothing left to
trigger a credit, wedging the stream permanently. Latent at the default 128 KB
window; immediate with a smaller one.

Fix (examples/echoserver/echoserver.c)

Two mechanisms, split by which side owns the backpressure:

• Local descriptors (pty, agent and forwarding sockets) stall only until the fd
  drains, so app_write_all() advances past each partial transfer and returns
  WS_FATAL_ERROR if it cannot complete.
• SSH channels stall until the peer's window reopens, which needs the loop to
  process inbound packets. Each direction stages into its WS_AppCtx buffer; the
  flush subtracts what was sent and WMEMMOVEs the remainder for the next pass.

Send result	Handling
> 0	subtract, keep the remainder
WS_CHANNEL_NOT_CONF, WS_CHAN_RXD, WS_WINDOW_FULL, WS_REKEYING	hold, retry on inbound data
WS_WANT_WRITE	hold, and add sshFd to a write set so select() wakes on writability

A descriptor stays out of the read set while its buffer is pending. Closes f-10544.

Fix (src/ssh.c)

wolfSSH_stream_read() consumes before crediting and always reports the byte count,
recording a failed adjust in ssh->error — the contract _ChannelReadExt() already
follows, so returning an error after consuming cannot drop the caller's bytes.

Tests

• test_wolfSSH_stream_read_WindowCredit() (tests/api.c) round-trips 2000 bytes
  through a 1024-byte client receive window against the echo server.
• test_stream_read_deferredWindowAdjust() (tests/unit.c) reads a full window with
  an IO send that reports WS_CBIO_ERR_WANT_WRITE.

Verification

• Full suite green: unit, api, testsuite, regress, kex, auth, and the
  scripts/ tests including fwd.test.
• Clean under -Werror across six GCC configurations; ASan + UBSan clean.
• Both tests fail with either fix reverted; the unit test also fails against an
  intermediate variant that consumed the bytes but returned the error.

[Copilot]

Pull request overview

This PR fixes data-loss and deadlock scenarios caused by partial writes in the echo server example and incorrect window-credit sequencing in wolfSSH_stream_read(). It also adds targeted regression tests to cover both the stream/window-credit behavior and the short-send retry logic in an integration-style scenario against the echo server.

Changes:

• Update wolfSSH_stream_read() to consume bytes before window crediting and always return the bytes copied, recording window-adjust send failures in ssh->error.
• Rework examples/echoserver/echoserver.c I/O loops to correctly handle partial sends/writes by buffering unsent data and retrying when the channel becomes writable/unblocked.
• Add new unit/API tests to validate deferred window adjust behavior and window credit round-tripping with a small receive window.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/ssh.c	Fixes stream read window-credit sequencing and return/error reporting behavior.
examples/echoserver/echoserver.c	Adds robust partial-write handling for shell/agent/forwarding paths and select() wakeups on WANT_WRITE.
tests/unit.c	Adds a unit regression test ensuring deferred window credit doesn’t “lose” consumed bytes.
tests/api.c	Adds an echoserver-gated API test that validates window credit recovery across a payload larger than the receive window.

Suppressed comments (1)

examples/echoserver/echoserver.c:1125

• In the agent relay path, agentChannelId is initialized to (word32)-1 and (per a file-wide search) is never updated, but it is passed to wolfSSH_ChannelIdRead()/wolfSSH_ChannelIdSend(). Since those APIs look up channels by self ID, this will consistently fail with WS_INVALID_CHANID and prevent agent forwarding from working. The code likely needs to plumb the correct self channel ID for the auth-agent channel into agentChannelId (or another tracked field) before attempting reads/sends.

                        if (lastChannel == agentChannelId) {
                            cnt_r = wolfSSH_ChannelIdRead(ssh, agentChannelId,
                                    threadCtx->channelBuffer,
                                    sizeof threadCtx->channelBuffer);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.