security alerts in busybox

[Roberto A. Foglietta]

On Sun, 26 Apr 2026 at 15:47, Tim Tassonis <stuff at decentral.ch> wrote:
>
> Hi Robbie
>
> On 4/25/26 17:48, Roberto A. Foglietta wrote:
> > On Sat, 25 Apr 2026 at 17:26, Tim Tassonis via busybox
> > <busybox at busybox.net> wrote:
> >>
> >>
> >>
> >> On 4/24/26 16:40, Roberto A. Foglietta via busybox wrote:
> >>> Hi,
> >>>
> >>> Using a static code analyser, I found:
> >>>
> >>> Open potentially alerts by severity/class in branch `main`:
> >>>
> >>> - **security**: 103 critical, 96 high, 4 medium, **203 total**
> >>>
> >>> Alerts above are related to C-language code, none otherwise.
> >
> > And that corner cases are altering the static internal ctime() buffer
> > and reading it isn't an atomic operation. Something  that busybox
> > developers were aware about because of the comments that they left in
> > the code and how they use multiple printf instead of single with
> > multiple ctime calls.
>
> Every idiot with more than two months of coding in C has found out the
> hard way about that..
>

And some stop there... and they are still stuck there... LOL

Best regards, R-