security alerts in busybox

[Tim Tassonis]

On 4/24/26 16:40, Roberto A. Foglietta via busybox wrote:
> Hi,
> 
> Using a static code analyser, I found:
> 
> Open potentially alerts by severity/class in branch `main`:
> 
> - **security**: 103 critical, 96 high, 4 medium, **203 total**
> 
> Alerts above are related to C-language code, none otherwise.
> 
> Are these false positives? Well, it is more about corner cases like
> using the applet in a strong parallel mode like xargs -p8 does. If
> used for maintenance on a large enough infrastructure, the corner case
> has a chance to be met, for example.
> 
> https://github.com/robang74/busybox/commits/security/

I looked at a few of those fixes, they seem to contain a lot of cases where

ctime gets replaced with the thread-safe" ctime_r

(for instance in ar.c)

looking at the function, the value is only used in a printf a little 
later, so your "fix" accomplishes exactly nothing at all except to make 
the static buffer visual in the code.

Now, for a program such as busybox that aims to be as compact as 
possible, I would rather call this a new defect than a security fix.

Just complaining about non-reentrant functions with static buffers is 
quite a lame way of "adding security", when no threads are used and the 
static buffer is only used once.

It's a bit like encrypting with 512 bit aes, or using password with a 
length of 64 characters...

Bye
Tim


> 
> commit f69e57f62798ae2bca9f5071adb45bfb002002b1 (HEAD -> security,
> origin/security)
> Author: Roberto A. Foglietta <roberto.foglietta at gmail.com>
> Date:   Fri Apr 24 15:33:58 2026 +0200
> 
>      util-linux/ipcs.c: use of potentially dangerous function (fix)
> 
>      Alerts: #96-93,91,88-83,81-77
> 
>      +:git-shell:security:busybox> size busybox
>         text    data     bss     dec     hex filename
>      1155501   18124    2056 1175681  11f081 busybox
>      1155670   18132    2056 1175858  11f132 busybox
>                                 +177
> 
> These are trivial alerts, therefore I faced it first to provide an
> example. And the second main question is straightforward: does this
> fix worth 177 bytes? In relative terms it is 150 ppm compared with the
> full size footprint. In terms of certifications is a solid step
> towards peace of mind.
> 
> Best regards, R-
> _______________________________________________
> busybox mailing list
> busybox at busybox.net
> https://lists.busybox.net/mailman/listinfo/busybox

-- 
decentral.ch - IT Stuff
Tim Tassonis
Badenerstrasse 219
8003 Zürich
stuff at decentral.ch
+41 79 229 36 17