Re: security alerts in busybox

On Sun, 26 Apr 2026 at 12:11, Roberto A. Foglietta
<[email protected]> wrote:
>
> On Sun, 26 Apr 2026 at 02:44, Roberto A. Foglietta
> <[email protected]> wrote:
> >
> > On Sat, 25 Apr 2026 at 23:21, Jody Bruchon via busybox
> > <[email protected]> wrote:
> > >
> > > Hey, while we're broadcasting our forks of BusyBox, here's mine.
> > ...
> > >
> > > https://codeberg.org/jbruchon/jbusybox
> >
> > //config: bool "jdupes (18.9 kb)"
> > //config: default y
> > //config: help
> > //config: A powerful duplicate file finder and manager
> >
> > default n
> >
>
> This function is reading data beyond its allocation, for sure in that branch
>
> /* Handle data tail (for blocks indivisible by sizeof(jduphash_t)) */
> len = getrest_in_jduphash(count);
> if (len) {
> partial_salt = JDUP_HASH_CONSTANT & tail_mask[len];
> element = *data & tail_mask[len];
>
> This happens because its prototype is flawed in its declaration:
>
> static jduphash_t jdup_block_hash(const jduphash_t * restrict data,
> const jduphash_t start_hash, const size_t count)
>
> cont should indicate the number of items not the size in bytes or by
> viceversa it is the size in bytes if the data is (void *) or (char *).
>
> Speed isn't the primary bonus for a hashing function but well
> spreading among the values space, thus having the least collision
> chance.
>
> What about the collision rate?

miscutils/jdupes.c: bug discovery + code janitoring p.1

Reducing the printouts text length:
   text    data     bss     dec     hex filename
  15811    1672     424   17907    45f3 miscutils/jdupes.o
  15502    1672     424   17598    44be miscutils/jdupes.o
Total changes:             +309

Please, check my changes, apply and extend them

~> https://github.com/robang74/busybox/tree/jodybox

Your jdups is interesting with its 18Kb compared to 45Kb of the
original but it requires some additional work.

First, shrink the length of the prints out to the bare minimum
necessary if any at all, then code readability (macros are your
friends).

Then bug fixing -- last but not least (and not also first in the todo
because once the code is readable bugs are expected not just one).

best regards, R-