Re: security alerts in busybox

On Sun, 26 Apr 2026 at 15:42, Jody Bruchon via busybox
<[email protected]> wrote:
>
> On 2026-04-26 6:11 AM, Roberto A. Foglietta wrote:
>  > This function is reading data beyond its allocation, for sure in that
> branch
>  > /* Handle data tail (for blocks indivisible by sizeof(jduphash_t)) */
> len = getrest_in_jduphash(count); if (len) { partial_salt =
> JDUP_HASH_CONSTANT & tail_mask[len]; element = *data & tail_mask[len];
>
> I don't know where you picked that poorly mangled code up but that's not
> what's in my branch at all:
> https://codeberg.org/jbruchon/jbusybox/src/branch/master/miscutils/jdupes.c#L508-L518

I agree that it is poorly managed, because it is your code written in
a manner that is easy to understand and as you quickly find out it is
poorly managed.

/* Handle data tail (for blocks indivisible by sizeof(jodyhash_t)) */
len = count & (sizeof(jodyhash_t) - 1);
if (len) {

In fact, it does not matter HOW you alloc the data buffer: the
prototype is still flawed in its definition and when data is allocated
in chunks of specific size, the second if never runs. Otherwise it
reads beyond the allocation. Which is exactly the "poorly managed"
definition of a coding style, I totally agree. Thanks for having said
that about your own code first. I would not have dared so much.

Best regards, R-