Apple-2gs-SW/hush
1
0
Fork 0
mirror of https://github.com/sheumann/hush.git synced 2024-07-28 22:29:07 +00:00
Code Issues Projects Releases Wiki Activity
b225e2a76b
hush/libbb
History
Eric Andersen 52499cb9ae Tito writes: 
Hi,
I've spent the half night staring at the devilish  my_getpwuid and my_getgrgid functions
trying to find out a way to avoid actual and future potential buffer overflow problems
without breaking existing code.
Finally I've  found a not intrusive way to do this that surely doesn't break existing code
and fixes a couple of problems too.
The attached patch:
1) changes the behaviour of my_getpwuid and my_getgrgid to avoid potetntial buffer overflows
2) fixes all occurences of this function calls in tar.c , id.c , ls.c, whoami.c, logger.c, libbb.h.
3) The behaviour of tar, ls and  logger is unchanged.
4) The behavior of ps with somewhat longer usernames messing up output is fixed.
5) The only bigger change was the increasing of size of the buffers in id.c to avoid
     false negatives (unknown user: xxxxxx) with usernames longer than 8 chars.
     The value i used ( 32 chars ) was taken from the tar header ( see gname and uname).
     Maybe this buffers can be reduced a bit  ( to 16 or whatever ), this is up to you.
6) The increase of size of the binary is not so dramatic:
     size busybox
       text    data     bss     dec     hex filename
     239568    2300   36816  278684   4409c busybox
    size busybox_fixed
       text    data     bss     dec     hex filename
     239616    2300   36816  278732   440cc busybox
7) The behaviour of whoami changed:
    actually it  prints out an username cut down to the size of the buffer.
    This could be fixed by increasing the size of the buffer as in id.c or
    avoid the use of my_getpwuid and use getpwuid directly instead.
    Maybe this colud be also remain unchanged......

Please apply if you think it is ok to do so.
The diff applies on today's cvs tarball (2004-08-25).
Thanks in advance,
Ciao,
Tito
2004-08-26 22:18:59 +00:00
..
.cvsignore update .cvsignore files to note new location of loop.h 2001-03-17 00:15:02 +00:00
ask_confirmation.c Major coreutils update. 2003-03-19 09:13:01 +00:00
bb_askpass.c Do not use getpass(3) 2004-05-01 01:27:30 +00:00
bb_asprintf.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
change_identity.c more crond+crontab integrating with loginutil libbb functions and deleted 2003-09-03 12:18:42 +00:00
chomp.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
compare_string_array.c Major coreutils update. 2003-03-19 09:13:01 +00:00
concat_path_file.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
concat_subpath_file.c Vodz, last_patch_86 2003-05-26 14:07:50 +00:00
copy_file.c Dont try and preserve hard links to directories. 2004-04-19 12:28:02 +00:00
copyfd.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
correct_password.c Do not use getpass(3) 2004-05-01 01:27:30 +00:00
create_icmp6_socket.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
create_icmp_socket.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
default_error_retval.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
device_open.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
dump.c Patch from Felipe Kellermann, "There is a call to printf using `*pr-cchar' 2004-07-23 01:35:41 +00:00
error_msg_and_die.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
error_msg.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
fclose_nonstdin.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
fflush_stdout_and_exit.c Major coreutils update. 2003-03-19 09:13:01 +00:00
fgets_str.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
find_mount_point.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
find_pid_by_name.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
find_root_device.c Tito, farmatito at tiscali dot it writes: 2004-08-03 00:14:02 +00:00
full_read.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
full_write.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
get_console.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
get_last_path_component.c Major coreutils update. 2003-03-19 09:13:01 +00:00
get_line_from_file.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
get_terminal_width_height.c Brian Pomerantz writes: 2004-03-23 23:15:36 +00:00
get_ug_id.c Patch from Arthur Othieno to fix a compiler warning 2003-10-22 10:26:38 +00:00
getopt_ulflags.c Vladimir N. Oleynik writes: 2004-02-05 13:49:29 +00:00
hash_fd.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
herror_msg_and_die.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
herror_msg.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
human_readable.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
inet_common.c In spite of the feature freeze, check in a complete rework of route which 2004-03-10 07:42:38 +00:00
inode_hash.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
interface.c Felipe Kellermann writes: 2004-08-26 21:45:21 +00:00
isdirectory.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
kernel_version.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
last_char_is.c Save 10 bytes or so, last_patch_70 from Vladimir N. Oleynik 2002-12-03 20:34:36 +00:00
llist_add_to.c Move add_to_list from libunarchive to libbb so it can be of more general use (eg ifupdown). Changed the name to llist_add_to as i plan on adding more llist_ functions as needed (e.g. llist_free). 2002-12-08 00:54:33 +00:00
login.c Geir Thomassen wrote, regarding networking/httpd.c line 1358 2003-06-26 09:05:32 +00:00
loop.c Use __kernel_old_dev_t for 2.6.x kernels 2004-08-16 08:36:28 +00:00
make_directory.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
Makefile Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
Makefile.in Patch from Bastian Blank: 2004-06-22 10:07:17 +00:00
messages.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
mode_string.c Fix a bug reported by junkio@cox.net involving the mode_chars index. 2003-08-14 02:28:49 +00:00
module_syscalls.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
mtab_file.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
mtab.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
my_getgrgid.c Tito writes: 2004-08-26 22:18:59 +00:00
my_getgrnam.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
my_getpwnam.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
my_getpwnamegid.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
my_getpwuid.c Tito writes: 2004-08-26 22:18:59 +00:00
obscure.c Patch from vodz to cleanup libbb/obscure.c:password_check() 2003-08-06 08:33:08 +00:00
parse_mode.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
parse_number.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
perror_msg_and_die.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
perror_msg.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
perror_nomsg_and_die.c Major coreutils update. 2003-03-19 09:13:01 +00:00
perror_nomsg.c Major coreutils update. 2003-03-19 09:13:01 +00:00
print_file.c Add missing include files 2004-03-27 11:26:32 +00:00
printf.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
process_escape_sequence.c Clean up hex escape support. 2004-07-29 23:15:16 +00:00
procps.c Tito writes: 2004-08-26 22:18:59 +00:00
pw_encrypt.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
pwd2spwd.c Cleanup shadow.h stuff so it behaves as intended 2002-07-03 04:47:43 +00:00
qmodule.c rmmod -a removed modules recursively 2002-12-14 01:58:59 +00:00
read_package_field.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
README Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
recursive_action.c Vladimir N. Oleynik writes: 2004-04-07 17:59:04 +00:00
remove_file.c Vodz, last_patch_86 2003-05-26 14:07:50 +00:00
restricted_shell.c Port over the last of the tinylogin applets 2002-06-23 04:24:25 +00:00
run_parts.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
run_shell.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
safe_read.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
safe_strncpy.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
safe_strtol.c Fix/eliminate use of atol 2004-03-06 22:11:45 +00:00
safe_write.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
setup_environment.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
simplify_path.c Major coreutils update. 2003-03-19 09:13:01 +00:00
skip_whitespace.c Major coreutils update. 2003-03-19 09:13:01 +00:00
speed_table.c Major coreutils update. 2003-03-19 09:13:01 +00:00
syscalls.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
syslog_msg_with_name.c Patch from Bastian Blank: 2004-06-22 10:07:17 +00:00
trim.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
u_signal_names.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
vdprintf.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
verror_msg.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
vfork_daemon_rexec.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
vherror_msg.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
vperror_msg.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
warn_ignoring_args.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
wfopen_input.c Major coreutils update. 2003-03-19 09:13:01 +00:00
wfopen.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
xconnect.c Larry Doolittle writes: 2004-04-14 17:51:38 +00:00
xfuncs.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
xgetcwd.c Vodz, last_patch_86 2003-05-26 14:07:50 +00:00
xgethostbyname2.c Major coreutils update. 2003-03-19 09:13:01 +00:00
xgethostbyname.c Major coreutils update. 2003-03-19 09:13:01 +00:00
xgetlarg.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
xgetularg.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
xreadlink.c Patch from Tito to fix memory leak upon error. 2004-08-11 03:50:30 +00:00
xregcomp.c Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00

README 

Please see the LICENSE file for copyright information (GPLv2)

libbb is BusyBox's utility library.  All of this stuff used to be stuffed into
a single file named utility.c.  When I split utility.c to create libbb, some of
the very oldest stuff ended up without their original copyright and licensing
information (which is now lost in the mists of time).  If you see something
that you wrote that is mis-attributed, do let me know so we can fix that up.

	Erik Andersen
	<andersen@codepoet.org>