Hi, I think I found a bug in libssh. It happens when calling *ssh_channel_write()* (which gets called in the callback set by ssh_set_channel_callbacks()).
The problem is that for some reason ssh_channel_write() ends up calling *ssh_poll_ctx_dopoll() *which at the same time will call the callback set with ssh_set_channel_callbacks() which again will call *ssh_channel_write().* If there are a lot of connections in the queue for *ssh_poll_ctx_dopoll() * to consume then recursion will happen and the crash will arise. *ssh_channel_write()* should do what it says, just writing to a channel and not calling *ssh_poll_ctx_dopoll() *again since if there other socket to read from recursion will happens and it will crash. Cheer -- Alberto GarcĂa Illera GPG Public Key <https://goo.gl/yshdwh>