fix CVE: upgrade busybox (1:1.37.0-4) unstable

Config.in

@@ -108,6 +108,17 @@ config LFS
 	programs that can benefit from large file support include dd, gzip,
 	cp, mount, tar.
 
+config TIME64
+	bool "Support 64bit wide time types"
+	default y
+	depends on LFS
+	help
+	Make times later than 2038 representable for several libc syscalls
+	(stat, clk_gettime etc.). Note this switch is specific to glibc
+	and has no effect on platforms that already use 64bit wide time types
+	(i.e. all 64bit archs and some selected 32bit archs (currently riscv
+	and x32)).
+
 config PAM
 	bool "Support PAM (Pluggable Authentication Modules)"
 	default n

Makefile

@@ -1,6 +1,6 @@
 VERSION = 1
-PATCHLEVEL = 36
-SUBLEVEL = 1
+PATCHLEVEL = 37
+SUBLEVEL = 0
 EXTRAVERSION =
 NAME = Unnamed
 
@@ -967,6 +967,7 @@ endif # CONFIG_MODULES
 # Directories & files removed with 'make clean'
 CLEAN_DIRS  += $(MODVERDIR) _install 0_lib
 CLEAN_FILES +=	busybox busybox_unstripped* busybox.links \
+		busybox*.suid busybox*.nosuid \
                 System.map .kernelrelease \
                 .tmp_kallsyms* .tmp_version .tmp_busybox* .tmp_System.map
 

Makefile.flags

@@ -15,6 +15,7 @@ CPPFLAGS += \
 	-include include/autoconf.h \
 	-D_GNU_SOURCE -DNDEBUG \
 	$(if $(CONFIG_LFS),-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64) \
+	$(if $(CONFIG_TIME64),-D_TIME_BITS=64) \
 	-DBB_VER=$(squote)$(quote)$(BB_VER)$(quote)$(squote)
 
 CFLAGS += $(call cc-option,-Wall,)
@@ -47,7 +48,7 @@ endif
 # gcc 3.x emits bogus "old style proto" warning on find.c:alloc_action()
 CFLAGS += $(call cc-ifversion, -ge, 0400, -Wold-style-definition)
 
-ifneq ($(CC),clang)
+ifneq ($(lastword $(subst -, ,$(CC))),clang)
 # "clang-9: warning: optimization flag '-finline-limit=0' is not supported
 CFLAGS += $(call cc-option,-finline-limit=0,)
 endif
@@ -65,7 +66,7 @@ CFLAGS += $(call cc-option,-static-libgcc,)
 endif
 
 CFLAGS += $(call cc-option,-falign-functions=1,)
-ifneq ($(CC),clang)
+ifneq ($(lastword $(subst -, ,$(CC))),clang)
 # "clang-9: warning: optimization flag '-falign-jumps=1' is not supported" (and same for other two)
 CFLAGS += $(call cc-option,-falign-jumps=1 -falign-labels=1 -falign-loops=1,)
 endif
@@ -78,7 +79,7 @@ CFLAGS += $(call cc-option,-fno-asynchronous-unwind-tables,)
 CFLAGS += $(call cc-option,-fno-builtin-printf,)
 
 # clang-9 does not like "str" + N and "if (CONFIG_ITEM && cond)" constructs
-ifeq ($(CC),clang)
+ifeq ($(lastword $(subst -, ,$(CC))),clang)
 CFLAGS += $(call cc-option,-Wno-string-plus-int -Wno-constant-logical-operand)
 endif
 

TODO

@@ -222,8 +222,6 @@ Minor stuff:
 ---
   unify progress_meter. wget, flash_eraseall, pipe_progress, fbsplash, setfiles.
 ---
-  support start-stop-daemon -d <chdir-path>
----
 
 (TODO list after discussion 11.05.2009)
 

applets/individual.c

@@ -20,5 +20,5 @@ int main(int argc, char **argv)
 void bb_show_usage(void)
 {
 	fputs_stdout(APPLET_full_usage "\n");
-	exit(EXIT_FAILURE);
+	exit_FAILURE();
 }

archival/bbunzip.c

@@ -415,7 +415,7 @@ int gunzip_main(int argc UNUSED_PARAM, char **argv)
 //usage:       "Decompress to stdout"
 
 //config:config BUNZIP2
-//config:	bool "bunzip2 (8.7 kb)"
+//config:	bool "bunzip2 (9.1 kb)"
 //config:	default y
 //config:	select FEATURE_BZIP2_DECOMPRESS
 //config:	help
@@ -429,7 +429,7 @@ int gunzip_main(int argc UNUSED_PARAM, char **argv)
 //config:	should probably say N here.
 //config:
 //config:config BZCAT
-//config:	bool "bzcat (8.7 kb)"
+//config:	bool "bzcat (9 kb)"
 //config:	default y
 //config:	select FEATURE_BZIP2_DECOMPRESS
 //config:	help
@@ -485,7 +485,7 @@ int bunzip2_main(int argc UNUSED_PARAM, char **argv)
 //usage:       "Decompress to stdout"
 
 //config:config UNLZMA
-//config:	bool "unlzma (7.5 kb)"
+//config:	bool "unlzma (7.8 kb)"
 //config:	default y
 //config:	help
 //config:	unlzma is a compression utility using the Lempel-Ziv-Markov chain
@@ -494,7 +494,7 @@ int bunzip2_main(int argc UNUSED_PARAM, char **argv)
 //config:	compressors.
 //config:
 //config:config LZCAT
-//config:	bool "lzcat (7.5 kb)"
+//config:	bool "lzcat (7.8 kb)"
 //config:	default y
 //config:	help
 //config:	Alias to "unlzma -c".

archival/cpio.c

@@ -62,7 +62,7 @@
 //usage:       " [-ti"IF_FEATURE_CPIO_O("o")"]" IF_FEATURE_CPIO_P(" [-p DIR]")
 //usage:       " [EXTR_FILE]..."
 //usage:#define cpio_full_usage "\n\n"
-//usage:       "Extract (-i) or list (-t) files from a cpio archive"
+//usage:       "Extract (-i) or list (-t) files from a cpio archive on stdin"
 //usage:	IF_FEATURE_CPIO_O(", or"
 //usage:     "\ntake file list from stdin and create an archive (-o)"
 //usage:                IF_FEATURE_CPIO_P(" or copy files (-p)")
@@ -504,7 +504,6 @@ int cpio_main(int argc UNUSED_PARAM, char **argv)
 			goto dump;
 		}
 		/* parent */
-		USE_FOR_NOMMU(argv[-optind][0] &= 0x7f); /* undo fork_or_rexec() damage */
 		xchdir(*argv++);
 		close(pp.wr);
 		xmove_fd(pp.rd, STDIN_FILENO);

archival/dpkg_deb.c

@@ -5,7 +5,7 @@
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
 //config:config DPKG_DEB
-//config:	bool "dpkg-deb (30 kb)"
+//config:	bool "dpkg-deb (29 kb)"
 //config:	default y
 //config:	select FEATURE_SEAMLESS_GZ
 //config:	help

archival/lzop.c

@@ -25,7 +25,7 @@
    "Minimalized" for busybox by Alain Knaff
 */
 //config:config LZOP
-//config:	bool "lzop (12 kb)"
+//config:	bool "lzop (13 kb)"
 //config:	default y
 //config:	help
 //config:	Lzop compression/decompresion.

archival/tar.c

@@ -621,7 +621,7 @@ static void NOINLINE vfork_compressor(int tar_fd, const char *gzip)
 		execlp(gzip, gzip, "-f", (char *)0);
 
 		vfork_exec_errno = errno;
-		_exit(EXIT_FAILURE);
+		_exit_FAILURE();
 	}
 
 	/* parent */

archival/unzip.c

@@ -559,6 +559,11 @@ int unzip_main(int argc, char **argv)
  *    204372                   1 file
  */
 
+//TODO: accept and ignore these?
+// -a	convert to text files with 't' label, -aa: all files
+// -b	do not convert to text - bbox: we don't convert anything
+// -D	skip restoration of timestamps for extracted items - bbox: we don't restore these (yet?)
+// -X	restore user:group ownership
 	opts = 0;
 	/* '-' makes getopt return 1 for non-options */
 	while ((i = getopt(argc, argv, "-d:lnotpqxjvK")) != -1) {
@@ -583,6 +588,7 @@ int unzip_main(int argc, char **argv)
 			xmove_fd(xopen("/dev/null", O_WRONLY), STDOUT_FILENO);
 			/*fallthrough*/
 
+// NB: -c extract files to stdout/screen (unlike -p, also prints .zip and file names to stdout)
 		case 'p': /* Extract files to stdout */
 			dst_fd = STDOUT_FILENO;
 			/*fallthrough*/
@@ -853,6 +859,7 @@ int unzip_main(int argc, char **argv)
 		unzip_skip(zip.fmt.extra_len);
 
 		/* Guard against "/abspath", "/../" and similar attacks */
+// NB: UnZip 6.00 has option -: to disable this
 		overlapping_strcpy(dst_fn, strip_unsafe_prefix(dst_fn));
 
 		/* Filter zip entries */

configs/TEST_nommu_defconfig

@@ -703,6 +703,7 @@ CONFIG_FEATURE_INETD_RPC=y
 CONFIG_IP=y
 CONFIG_FEATURE_IP_ADDRESS=y
 CONFIG_FEATURE_IP_LINK=y
+CONFIG_FEATURE_IP_LINK_CAN=y
 CONFIG_FEATURE_IP_ROUTE=y
 CONFIG_FEATURE_IP_TUNNEL=y
 CONFIG_FEATURE_IP_RULE=y