Re: Isar v1.1 Release Candidate 2

["Roberto A. Foglietta" <roberto.foglietta@gmail.com>]

On Mon, 4 May 2026 at 12:02, Zhihang Wei <wzh@ilbers.de> wrote:
>
> Hi everyone,
>
> I have just tagged v1.1-rc2 as release candidate 2 for Isar v1.1.
>
> Please test on your downstream if necessary. Feedback is welcome.
>

Hi, I propose you consider a couple of patches of mine
for busybox to include in ISAR as external patches.

WHY APPLY THIS ONE IN PARTICULAR?

https://github.com/robang74/busybox/blob/master/TODO.md#awk

In this case, using awk w/ CONVFMT and a properly forged text string
containing %1337c%n due to arbitrary of 1337 (at my will) and %n
property I could **POTENTIALLY** escalate the privileges to root. In
fact busybox is a single binary usually with SUID attribute and the
fork() brings the whole process in memory usually in CoW mode,
including those applets that can run with root privileges by SUID
(cfr. man chmod +s).

URL: https://github.com/robang74/busybox/tree/master/patches

patches/
- 0002-awk-minimalist-approach-to-fix-some-unsupported-cases-v4.patch

    awk: numeric identifiers full recognition, +65b (patchset v4)

    Fixing: two major issues like walking %016llx and writing %n
    Extend: support for "%fpx", keep "pi:%f" and earn "pi: %f deg"
    Testing: editors/awk_printx_tests.sh added new (only visual)

./busybox awk 'BEGIN { CONVFMT="%nf"; x=3.14; print x "" }';
./busybox awk 'BEGIN { CONVFMT="%.2f OK f"; x=3.14; print x "" }';
./busybox awk 'BEGIN { CONVFMT="%.2fpi %016llx f"; x=3.14; print x "" }';
./busybox awk 'BEGIN { CONVFMT="walk: %.2fpi %016llx "; x=3.14; print x "" }'
./busybox awk 'BEGIN { CONVFMT="OK pi: %.2fx"; x=3.14; print x "" }'
./busybox awk 'BEGIN { CONVFMT="%.2fOKpi"; x=3.14; print x "" }'

       text    data     bss     dec     hex filename
      19338       0       0   19338    4b8a editors/awk.o
    Fixing:                     +51
      19389       0       0   19389    4bbd editors/awk.o
    Extend:                     +16
      19405       0       0   19405    4bcd editors/awk.o
    Coding:                      -2
      19403       0       0   19403    4bcb editors/awk.o





--
Roberto A. Foglietta
+49.176.274.75.661
+39.349.33.30.697

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/CAJGKYO4t332j3FL01uVVC-m8A73sNaJdF9bHNVz1ziwYxW%2B2yA%40mail.gmail.com.