Re: security alerts in busybox

Hey, while we're broadcasting our forks of BusyBox, here's mine. It's 
probably not very interesting to anyone, but I feel like if someone can 
slap _r onto a bunch of functions that don't necessarily need thread 
safety, I can slap get_d_namlen() and my personal gripes into a few of 
them myself.

https://codeberg.org/jbruchon/jbusybox

I expect all of you to try my minimally changed code and mock me 
copiously. If you don't, I will penalize you all by continuing to not 
improve my fork.

- Jody Bruchon
Senior Maintainer of yet another BusyBox fork no one asked for or wanted

:-)


On 2026-04-24 10:40 AM, Roberto A. Foglietta via busybox wrote:
> Hi,
>
> Using a static code analyser, I found:
>
> Open potentially alerts by severity/class in branch `main`:
>
> - **security**: 103 critical, 96 high, 4 medium, **203 total**
>
> Alerts above are related to C-language code, none otherwise.
>
> Are these false positives? Well, it is more about corner cases like
> using the applet in a strong parallel mode like xargs -p8 does. If
> used for maintenance on a large enough infrastructure, the corner case
> has a chance to be met, for example.
>
> https://github.com/robang74/busybox/commits/security/
>
> commit f69e57f62798ae2bca9f5071adb45bfb002002b1 (HEAD -> security,
> origin/security)
> Author: Roberto A. Foglietta <[email protected]>
> Date:   Fri Apr 24 15:33:58 2026 +0200
>
>      util-linux/ipcs.c: use of potentially dangerous function (fix)
>
>      Alerts: #96-93,91,88-83,81-77
>
>      +:git-shell:security:busybox> size busybox
>         text    data     bss     dec     hex filename
>      1155501   18124    2056 1175681  11f081 busybox
>      1155670   18132    2056 1175858  11f132 busybox
>                                 +177
>
> These are trivial alerts, therefore I faced it first to provide an
> example. And the second main question is straightforward: does this
> fix worth 177 bytes? In relative terms it is 150 ppm compared with the
> full size footprint. In terms of certifications is a solid step
> towards peace of mind.
>
> Best regards, R-
> _______________________________________________
> busybox mailing list
> [email protected]
> https://lists.busybox.net/mailman/listinfo/busybox