Bug#701968: several busybox applets may fail or produce garbage
Package: busybox
Version: 1:1.20.0-7
Severity: important
Tags: patch upstream fixed-upstream pending
Several bugs (typos) has been found in busybox in macros that
performs conversion from host words to unaligned buffers, one
in generic code and two more in compression library (xz).
First bug (generic move_to_unaligned16() implementation) copies
2 more bytes than necessary, thus can overflow the destination,
which may cause either memory corruption or a segmentation fault.
Second bug in xz is wrong usage of move_to_unaligned16 (which
copied 4 instead of 2 bytes by accident) to handle 32bit
quantities - is exposed when the first bug is fixed.
Other usages of move_to_unaligned16() in whole busybox sources
appears to be okay.
The severity is important because the overflow usually goes
silent but may produce garbage output, which leads to data
corruption in archivals. Reportedly this happens on sparc.
/mjt
Reply to: