mirror of
https://github.com/sheumann/hush.git
synced 2024-11-05 06:07:00 +00:00
hush (a Bourne-style shell) for the GNO multitasking environment on the Apple IIgs
52499cb9ae
Hi,
I've spent the half night staring at the devilish my_getpwuid and my_getgrgid functions
trying to find out a way to avoid actual and future potential buffer overflow problems
without breaking existing code.
Finally I've found a not intrusive way to do this that surely doesn't break existing code
and fixes a couple of problems too.
The attached patch:
1) changes the behaviour of my_getpwuid and my_getgrgid to avoid potetntial buffer overflows
2) fixes all occurences of this function calls in tar.c , id.c , ls.c, whoami.c, logger.c, libbb.h.
3) The behaviour of tar, ls and logger is unchanged.
4) The behavior of ps with somewhat longer usernames messing up output is fixed.
5) The only bigger change was the increasing of size of the buffers in id.c to avoid
false negatives (unknown user: xxxxxx) with usernames longer than 8 chars.
The value i used ( 32 chars ) was taken from the tar header ( see gname and uname).
Maybe this buffers can be reduced a bit ( to 16 or whatever ), this is up to you.
6) The increase of size of the binary is not so dramatic:
size busybox
text data bss dec hex filename
239568 2300 36816 278684 4409c busybox
size busybox_fixed
text data bss dec hex filename
239616 2300 36816 278732 440cc busybox
7) The behaviour of whoami changed:
actually it prints out an username cut down to the size of the buffer.
This could be fixed by increasing the size of the buffer as in id.c or
avoid the use of my_getpwuid and use getpwuid directly instead.
Maybe this colud be also remain unchanged......
Please apply if you think it is ok to do so.
The diff applies on today's cvs tarball (2004-08-25).
Thanks in advance,
Ciao,
Tito
|
||
|---|---|---|
| applets | ||
| archival | ||
| console-tools | ||
| coreutils | ||
| debian | ||
| debianutils | ||
| docs | ||
| editors | ||
| examples | ||
| findutils | ||
| include | ||
| init | ||
| libbb | ||
| libpwdgrp | ||
| loginutils | ||
| miscutils | ||
| modutils | ||
| networking | ||
| patches | ||
| procps | ||
| scripts | ||
| shell | ||
| sysdeps/linux | ||
| sysklogd | ||
| testsuite | ||
| util-linux | ||
| .cvsignore | ||
| .indent.pro | ||
| AUTHORS | ||
| Changelog | ||
| INSTALL | ||
| LICENSE | ||
| Makefile | ||
| README | ||
| Rules.mak | ||
| TODO | ||
Please see the LICENSE file for details on copying and usage.
BusyBox combines tiny versions of many common UNIX utilities into a single
small executable. It provides minimalist replacements for most of the utilities
you usually find in GNU coreutils, util-linux, etc. The utilities in BusyBox
generally have fewer options than their full-featured GNU cousins; however, the
options that are included provide the expected functionality and behave very
much like their GNU counterparts.
BusyBox has been written with size-optimization and limited resources in mind.
It is also extremely modular so you can easily include or exclude commands (or
features) at compile time. This makes it easy to customize your embedded
systems. To create a working system, just add /dev, /etc, and a Linux kernel.
BusyBox provides a fairly complete POSIX environment for any small or embedded
system.
BusyBox is extremely configurable. This allows you to include only the
components you need, thereby reducing binary size. Run 'make config' or
'make menuconfig' to select the functionality that you wish to enable.
After the build is complete, a busybox.links file is generated. This is
used by 'make install' to create symlinks to the BusyBox binary for all
compiled in functions. By default, 'make install' will place the symlink
forest into `pwd`/_install unless you have defined the PREFIX environment
variable (i.e., 'make PREFIX=/tmp/foo install')
If you wish to install hard links, rather than symlinks, you can use
'make PREFIX=/tmp/foo install-hardlinks' instead.
----------------
Supported architectures:
BusyBox in general will build on any architecture supported by gcc. It has
a few specialized features added for __sparc__ and __alpha__. insmod
functionality is currently limited to x86, ARM, SH3/4, powerpc, m68k,
MIPS, cris, and v850e.
Supported C Libraries:
glibc-2.0.x, glibc-2.1.x, glibc-2.2.x, glibc-2.3.x, uClibc. People
are looking at newlib and diet-libc, but consider them unsupported,
untested, or worse. Linux-libc5 is no longer supported -- you
should probably use uClibc instead if you want a small C library.
Supported kernels:
Full functionality requires Linux 2.2.x or better. A large fraction of the
code should run on just about anything. While the current code is fairly
Linux specific, it should be fairly easy to port the majority of the code
to, say, FreeBSD or Solaris, or Mac OS X, or even Windows (if you are into
that sort of thing).
----------------
Getting help:
When you find you need help, you can check out the BusyBox mailing list
archives at http://busybox.net/lists/busybox/ or even join
the mailing list if you are interested.
----------------
Bugs:
If you find bugs, please submit a detailed bug report to the BusyBox mailing
list at busybox@mail.busybox.net. A well-written bug report should include a
transcript of a shell session that demonstrates the bad behavior and enables
anyone else to duplicate the bug on their own machine. The following is such
an example:
To: busybox@mail.busybox.net
From: diligent@testing.linux.org
Subject: /bin/date doesn't work
Package: BusyBox
Version: 1.00
When I execute BusyBox 'date' it produces unexpected results.
With GNU date I get the following output:
$ date
Sat Mar 27 14:19:41 MST 2004
But when I use BusyBox date I get this instead:
$ date
illegal instruction
I am using Debian unstable, kernel version 2.4.25-vrs2 on a Netwinder,
and the latest uClibc from CVS. Thanks for the wonderful program!
-Diligent
Note the careful description and use of examples showing not only what BusyBox
does, but also a counter example showing what an equivalent GNU app does. Bug
reports lacking such detail may never be fixed... Thanks for understanding.
----------------
Downloads:
Source for the latest released version, as well as daily snapshots, can always
be downloaded from
http://busybox.net/downloads/
----------------
CVS:
BusyBox now has its own publicly browsable CVS tree at:
http://busybox.net/cgi-bin/cvsweb/busybox/
Anonymous CVS access is available. For instructions, check out:
http://busybox.net/cvs_anon.html
For those that are actively contributing there is even CVS write access:
http://busybox.net/cvs_write.html
----------------
Please feed suggestions, bug reports, insults, and bribes back to:
Erik Andersen
<andersen@codepoet.org>