[PATCH 1/2] Allow BusyBox to be built without a list of applet names

[Tito]

On 04/29/2016 11:01 PM, Jody Lee Bruchon wrote:
> On April 29, 2016 4:37:56 PM EDT, Aaro Koskinen <aaro.koskinen at iki.fi> wrote:
>> Hi,
>>
>> On Fri, Apr 29, 2016 at 12:05:24PM -0700, ..mg.. wrote:
>>> The lookup hash isn't collision-free: more than one input string
>>> points to the same applet.  Normally invalid applet names might
>>> cause an unexpected one to run
>>
>> Highly insecure, no?
>
> Maybe. Maybe not. No hash algorithm is collision-free, but as far as security goes it wouldn't be any less secure
 > than normal. One would have to symlink or copy the binary to an 
intentionally colliding command name and even
 > then it's not like the privileges would be magically escalated.

Hi,
shouldn't it be enough to call:

busybox somename

for having a collision?

Ciao,
Tito


> I want to know why the algorithm returns uint32_t but casts the calculated hash to uint16_t prior to returning it.