jsch.addIdentity() fails with IndexOutOfBounds when private key has CRLF line breaks

[AmairK00]

Hi,

The below code does not work since the latest 0.2.10 release. Up to 0.2.9 this is working fine.
I don't have much idea on the library, so I cannot say if I have to use something different or if there is a configuration.
Please let me know.

String pkey="Key with CRLF linebreaks'
Jsch jsch = new Jsch()
jsch.addIndentity("file",pkey.getBytes(),null,null) // fails with ArrayIndexOutofBoundsException

logs:

java.lang.ArrayIndexOutOfBoundsException: arraycopy: last source index 1190 out of bounds for byte[1176]
	at java.base/java.lang.System.arraycopy(Native Method)
	at com.jcraft.jsch.KeyPairRSA.parse(KeyPairRSA.java:337)
	at com.jcraft.jsch.KeyPair.load(KeyPair.java:1126)
	at com.jcraft.jsch.IdentityFile.newInstance(IdentityFile.java:44)
	at com.jcraft.jsch.JSch.addIdentity(JSch.java:515)
	at com.test.jsch.JschMain.main(JschMain.java:60)

Exception in thread "main" com.jcraft.jsch.JSchException: invalid privatekey
	at com.jcraft.jsch.KeyPair.load(KeyPair.java:1129)
	at com.jcraft.jsch.IdentityFile.newInstance(IdentityFile.java:44)
	at com.jcraft.jsch.JSch.addIdentity(JSch.java:515)
	at com.test.jsch.JschMain.main(JschMain.java:60)

[norrisjeremy]

HI @AmairK00,

1. What type of private key are you using?

• Does it start with -----BEGIN OPENSSH PRIVATE KEY-----?
• Or does it start with -----BEGIN RSA PRIVATE KEY-----?
• Or does it start with something else?

2. Do I understand correctly the private key utilizes Windows type line endings (\r\n) and not Unix type line endings (\n)?

• If so, can you confirm if the private key works if you switch it to using Unix type line endings (\n) instead?

Thanks,
Jeremy

[gmicherinas]

Hi all,
As OP said, my tests work as intended till 0.2.9. with 0.2.10 and I got this exact error.
I use jsch as part of camel-ftp with PK authentication as well.

I too had my keys with CRLF line endings. After changing them to LF my tests passed.

So I guess, I can also validate that the root cause should be that keys with CRLF aren't parsed correctly as @AmairK00 said.

[gmicherinas]

Mine starts with -----BEGIN OPENSSH PRIVATE KEY-----

[norrisjeremy]

Ok, I have replicated this locally and will try to determine a solution.

[AmairK00]

It starts with ----BEGIN RSA PRIVATE KEY-----. Yeah the key works when I change it to only '\n'

[norrisjeremy]

Hi @AmairK00 & @gmicherinas,

Can you test with the JSch jar produced by Github CI from our latest changed located here and confirm if it fixes the issues you are seeing with files containing \r\n?

Thanks,
Jeremy

[norrisjeremy]

Hi @AmairK00 & @gmicherinas,

Actually we have made a new 0.2.11 release that hopefully fixes this regression: can you test and confirm?

Thanks,
Jeremy

[AmairK00]

Hi @norrisjeremy

The fix works for me. Thanks for the update.

[gmicherinas]

with 0.2.10

with 0.2.11.SNAPSHOT

So, it resolves (at least) my problem.

I'll stick to 0.2.9 till 0.2.11 is released. (I'll update to 0.2.11 after all :))
Thanks a lot @norrisjeremy for the quick resolution. 👍