Re: security alerts in busybox

On 2026-04-26 6:11 AM, Roberto A. Foglietta wrote:
 > This function is reading data beyond its allocation, for sure in that 
branch
 > /* Handle data tail (for blocks indivisible by sizeof(jduphash_t)) */ 
len = getrest_in_jduphash(count); if (len) { partial_salt = 
JDUP_HASH_CONSTANT & tail_mask[len]; element = *data & tail_mask[len];

I don't know where you picked that poorly mangled code up but that's not 
what's in my branch at all:
https://codeberg.org/jbruchon/jbusybox/src/branch/master/miscutils/jdupes.c#L508-L518

The allocation is required to be sized in uint32_t wide units, so it's 
never going to run off the edge of the buffer:
typedef uint32_t jodyhash_t;
typedef jodyhash_t jdupes_hash_t;
...
static jdupes_hash_t hash[1];
static jdupes_hash_t *chunk = NULL;
...
chunk = (jdupes_hash_t *)xmalloc(CHUNK_SIZE);

As for your concerns regarding hash collisions, read what the hash 
function is used for first (hint: not everything needs to be SHA512):
https://codeberg.org/jbruchon/jdupes/src/branch/master/README.md?display=source#L600-L611

A collision in this context will result in a failure to fast exclude. It 
means the file moves on to the next level of processing, but the 
byte-for-byte check will always exclude a true negative pair. I would 
have used xxHash but I seriously doubt BusyBox will ever accept that 
code being added, so I used my much less complex hash function instead.