Re: security alerts in busybox

On Sun, 26 Apr 2026 at 02:44, Roberto A. Foglietta
<[email protected]> wrote:
>
> On Sat, 25 Apr 2026 at 23:21, Jody Bruchon via busybox
> <[email protected]> wrote:
> >
> > Hey, while we're broadcasting our forks of BusyBox, here's mine.
> ...
> >
> > https://codeberg.org/jbruchon/jbusybox
>
> //config: bool "jdupes (18.9 kb)"
> //config: default y
> //config: help
> //config: A powerful duplicate file finder and manager
>
> default n
>

This function is reading data beyond its allocation, for sure in that branch

/* Handle data tail (for blocks indivisible by sizeof(jduphash_t)) */
len = getrest_in_jduphash(count);
if (len) {
partial_salt = JDUP_HASH_CONSTANT & tail_mask[len];
element = *data & tail_mask[len];

This happens because its prototype is flawed in its declaration:

static jduphash_t jdup_block_hash(const jduphash_t * restrict data,
const jduphash_t start_hash, const size_t count)

cont should indicate the number of items not the size in bytes or by
viceversa it is the size in bytes if the data is (void *) or (char *).

Speed isn't the primary bonus for a hashing function but well
spreading among the values space, thus having the least collision
chance.

What about the collision rate?