emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
4,236 Commits 1 Branch 0 Tags 33 MiB
C 93.2%
Shell 4.1%
Assembly 1%
Makefile 0.7%
C++ 0.5%
Other 0.2%
52499cb9ae
Go to file
Eric Andersen 52499cb9ae Tito writes: 
Hi,
I've spent the half night staring at the devilish  my_getpwuid and my_getgrgid functions
trying to find out a way to avoid actual and future potential buffer overflow problems
without breaking existing code.
Finally I've  found a not intrusive way to do this that surely doesn't break existing code
and fixes a couple of problems too.
The attached patch:
1) changes the behaviour of my_getpwuid and my_getgrgid to avoid potetntial buffer overflows
2) fixes all occurences of this function calls in tar.c , id.c , ls.c, whoami.c, logger.c, libbb.h.
3) The behaviour of tar, ls and  logger is unchanged.
4) The behavior of ps with somewhat longer usernames messing up output is fixed.
5) The only bigger change was the increasing of size of the buffers in id.c to avoid
     false negatives (unknown user: xxxxxx) with usernames longer than 8 chars.
     The value i used ( 32 chars ) was taken from the tar header ( see gname and uname).
     Maybe this buffers can be reduced a bit  ( to 16 or whatever ), this is up to you.
6) The increase of size of the binary is not so dramatic:
     size busybox
       text    data     bss     dec     hex filename
     239568    2300   36816  278684   4409c busybox
    size busybox_fixed
       text    data     bss     dec     hex filename
     239616    2300   36816  278732   440cc busybox
7) The behaviour of whoami changed:
    actually it  prints out an username cut down to the size of the buffer.
    This could be fixed by increasing the size of the buffer as in id.c or
    avoid the use of my_getpwuid and use getpwuid directly instead.
    Maybe this colud be also remain unchanged......

Please apply if you think it is ok to do so.
The diff applies on today's cvs tarball (2004-08-25).
Thanks in advance,
Ciao,
Tito
2004-08-26 22:18:59 +00:00
applets
archival Tito writes: 2004-08-26 22:18:59 +00:00
console-tools
coreutils Tito writes: 2004-08-26 22:18:59 +00:00
debian
debianutils
docs Prepare for release 2004-08-16 10:29:29 +00:00
editors regularly update the status line display 2004-08-19 19:15:06 +00:00
examples
findutils Make the grep option values a bit less horrible 2004-05-26 11:48:29 +00:00
include Tito writes: 2004-08-26 22:18:59 +00:00
init Do not use vfork, as init is not vfork safe. Do not allow 2004-08-16 09:29:42 +00:00
libbb Tito writes: 2004-08-26 22:18:59 +00:00
libpwdgrp Replace the old and somewhat buggy pwd_grp stuff with the shiny 2004-07-15 12:53:49 +00:00
loginutils Patch from Manousaridis Angelos to cleanup stale file descriptors, it was preventing unmounting an initial filesystem. 2004-08-25 02:02:19 +00:00
miscutils Fix incorrect arguments being passed to mknod 2004-07-30 17:48:21 +00:00
modutils Patch from Rodney Radford adding x86_64 support. 2004-08-19 19:17:30 +00:00
networking Set default command to list rather than get, its default behaviour now 2004-08-11 08:10:58 +00:00
patches Patch from Adam Slattery to add bzip2 support to rpm2cpio 2004-07-23 01:20:57 +00:00
procps Patch from Tito adding support for '-q' 2004-08-19 18:26:26 +00:00
scripts Peter Kjellerstedt at axis.com writes: 2004-07-15 06:01:05 +00:00
shell Patch from Vladimir N. Oleynik: 2004-08-19 18:22:13 +00:00
sysdeps/linux Update the default config to not ask stuff 2004-07-20 06:06:56 +00:00
sysklogd Tito writes: 2004-08-26 22:18:59 +00:00
testsuite Add two fundamental tests for copying directories 2004-04-18 13:35:56 +00:00
util-linux Tito, farmatito at tiscali dot it writes: 2004-08-03 00:14:02 +00:00
.cvsignore
.indent.pro
AUTHORS document stuff I have done 2004-07-26 18:57:49 +00:00
Changelog Prepare for release 2004-08-16 10:29:29 +00:00
INSTALL
LICENSE
Makefile The 'tests' target is long gone. 2004-07-20 06:04:28 +00:00
README
Rules.mak Bump version 2004-08-16 10:23:33 +00:00
TODO Re-add the TODO list, mention tr 2004-05-01 00:49:49 +00:00

README 

Please see the LICENSE file for details on copying and usage.

BusyBox combines tiny versions of many common UNIX utilities into a single
small executable. It provides minimalist replacements for most of the utilities
you usually find in GNU coreutils, util-linux, etc. The utilities in BusyBox
generally have fewer options than their full-featured GNU cousins; however, the
options that are included provide the expected functionality and behave very
much like their GNU counterparts.

BusyBox has been written with size-optimization and limited resources in mind.
It is also extremely modular so you can easily include or exclude commands (or
features) at compile time. This makes it easy to customize your embedded
systems. To create a working system, just add /dev, /etc, and a Linux kernel.
BusyBox provides a fairly complete POSIX environment for any small or embedded
system.

BusyBox is extremely configurable.  This allows you to include only the
components you need, thereby reducing binary size. Run 'make config' or
'make menuconfig' to select the functionality that you wish to enable.

After the build is complete, a busybox.links file is generated.  This is
used by 'make install' to create symlinks to the BusyBox binary for all
compiled in functions.  By default, 'make install' will place the symlink
forest into `pwd`/_install unless you have defined the PREFIX environment
variable (i.e., 'make PREFIX=/tmp/foo install')

If you wish to install hard links, rather than symlinks, you can use
'make PREFIX=/tmp/foo install-hardlinks' instead.

----------------

Supported architectures:

   BusyBox in general will build on any architecture supported by gcc.  It has
   a few specialized features added for __sparc__ and __alpha__.  insmod
   functionality is currently limited to x86, ARM, SH3/4, powerpc, m68k,
   MIPS, cris, and v850e.

Supported C Libraries:

   glibc-2.0.x, glibc-2.1.x, glibc-2.2.x, glibc-2.3.x, uClibc.  People
   are looking at newlib and diet-libc, but consider them unsupported,
   untested, or worse.  Linux-libc5 is no longer supported -- you
   should probably use uClibc instead if you want a small C library.

Supported kernels:

   Full functionality requires Linux 2.2.x or better.  A large fraction of the
   code should run on just about anything.  While the current code is fairly
   Linux specific, it should be fairly easy to port the majority of the code
   to, say, FreeBSD or Solaris, or Mac OS X, or even Windows (if you are into
   that sort of thing).

----------------

Getting help:

When you find you need help, you can check out the BusyBox mailing list
archives at http://busybox.net/lists/busybox/ or even join
the mailing list if you are interested.

----------------

Bugs:

If you find bugs, please submit a detailed bug report to the BusyBox mailing
list at busybox@mail.busybox.net.  A well-written bug report should include a
transcript of a shell session that demonstrates the bad behavior and enables
anyone else to duplicate the bug on their own machine. The following is such
an example:

    To: busybox@mail.busybox.net
    From: diligent@testing.linux.org
    Subject: /bin/date doesn't work

    Package: BusyBox
    Version: 1.00

    When I execute BusyBox 'date' it produces unexpected results.
    With GNU date I get the following output:

	$ date
	Sat Mar 27 14:19:41 MST 2004

    But when I use BusyBox date I get this instead:

	$ date
	illegal instruction

    I am using Debian unstable, kernel version 2.4.25-vrs2 on a Netwinder,
    and the latest uClibc from CVS.  Thanks for the wonderful program!

	-Diligent

Note the careful description and use of examples showing not only what BusyBox
does, but also a counter example showing what an equivalent GNU app does.  Bug
reports lacking such detail may never be fixed...  Thanks for understanding.

----------------

Downloads:

Source for the latest released version, as well as daily snapshots, can always
be downloaded from
    http://busybox.net/downloads/

----------------

CVS:

BusyBox now has its own publicly browsable CVS tree at:
    http://busybox.net/cgi-bin/cvsweb/busybox/

Anonymous CVS access is available.  For instructions, check out:
    http://busybox.net/cvs_anon.html

For those that are actively contributing there is even CVS write access:
    http://busybox.net/cvs_write.html

----------------

Please feed suggestions, bug reports, insults, and bribes back to:
	Erik Andersen
	<andersen@codepoet.org>