segfault bb_make_directory + dirname with musl
Daniel Sabogal
dsabogalcc at gmail.com
Wed Nov 30 02:46:22 UTC 2016
The following commands cause busybox to segfault on musl-based systems.
$ install -D a /
$ install -D a /b
$ install -D a /b/
This happens because the code in
https://git.busybox.net/busybox/tree/coreutils/install.c?h=1_25_1#n196
passes the result of dirname() to bb_make_directory() which modifies its
contents. For paths of the above forms, musl's dirname returns a string
literal "/" which shouldn't be modified.
See http://git.musl-libc.org/cgit/musl/tree/src/misc/dirname.c
There are a few other occurrences of the code shown above, but I've not
checked to see if they could be made to segfault.
More information about the busybox
mailing list