[PATCH 1/2] Allow BusyBox to be built without a list of applet names

Jody Lee Bruchon jody at jodybruchon.com
Fri Apr 29 21:01:21 UTC 2016


On April 29, 2016 4:37:56 PM EDT, Aaro Koskinen <aaro.koskinen at iki.fi> wrote:
>Hi,
>
>On Fri, Apr 29, 2016 at 12:05:24PM -0700, ..mg.. wrote:
>> The lookup hash isn't collision-free: more than one input string
>> points to the same applet.  Normally invalid applet names might
>> cause an unexpected one to run
>
>Highly insecure, no?

Maybe. Maybe not. No hash algorithm is collision-free, but as far as security goes it wouldn't be any less secure than normal. One would have to symlink or copy the binary to an intentionally colliding command name and even then it's not like the privileges would be magically escalated.

I want to know why the algorithm returns uint32_t but casts the calculated hash to uint16_t prior to returning it.


More information about the busybox mailing list