busybox-w32/shell, branch waitfor

ash: allow wait to handle more than 64 processes

2026-07-16T13:09:16+00:00

WaitForMultipleObjects() can only handle 64 processes (actually, MAXIMUM_WAIT_OBJECTS) in a single call. Using the 'wait' shell built-in after a command like: for i in $(seq 1 70); do echo $i; sleep 10 & done resulted in an uninterruptible 'wait'. Handle processes in batches of MAXIMUM_WAIT_OBJECTS. The problem was noted by Morgan Bartlett, who also supplied a fix which I claim to have 'improved'. Adds 32-48 bytes. Signed-off-by: Ron Yorston

Merge branch 'busybox' into merge

2026-07-08T13:32:00+00:00

Signed-off-by: Ron Yorston

ash: fix out-of-bounds read in ifsbreakup()

2026-07-06T08:30:30+00:00

ifsfree() does not only release allocated ifsregion nodes; it also clears the global IFS region state used by ifsbreakup(). If argstr() raises an error while expanding an argument, ash longjmps out of expandarg() before that cleanup runs, leaving stale IFS split offsets behind. A later expansion can reuse the stack for a shorter string. ifsbreakup() then sees the stale IFS state, trusts the old offsets, and can walk past the current stack block before dereferencing p. Follow dash's root-cause fix: when an expansion-related handler catches EXERROR and continues, restore the handler and call ifsfree(). Apply the cleanup to redirectsafe(), expandstr(), and evaltree(). Upstream commit: Date: Mon Dec 5 23:02:01 2022 +0800 expand: Add ifsfree to expand to fix a logic error that causes a buffer over-read On Mon, Jun 20, 2022 at 02:27:10PM -0400, Alex Gorinson wrote: > Due to a logic error in the ifsbreakup function in expand.c if a > heredoc and normal command is run one after the other by means of a > semi-colon, when the second command drops into ifsbreakup the command > will be evaluated with the ifslastp/ifsfirst struct that was set when > the here doc was evaluated. This results in a buffer over-read that > can leak the program's heap, stack, and arena addresses which can be > used to beat ASLR. > > Steps to Reproduce: > First bug: > cmd args: ~/exampleDir/example> dash > $ M='AAAAAAAAAAAAAAAAA' > $ q00(){ > $ <<000;echo > $ ${D?$M$M$M$M$M$M} > $ 000 > $ } > $ q00 should be echo'd out; this works with ash, busybox ash, and dash and > with all option args.> > > Patch: > Adding the following to expand.c will fix both bugs in one go. > (Thank you to Harald van Dijk and Michael Greenberg for doing the > heavy lifting for this patch!) > ========================== > --- a/src/expand.c > +++ b/src/expand.c > @@ -859,6 +859,7 @@ > if (discard) > return -1; > > +ifsfree(); > sh_error("Bad substitution"); > } > > @@ -1739,6 +1740,7 @@ > } else > msg = umsg; > } > +ifsfree(); > sh_error("%.*s: %s%s", end - var - 1, var, msg, tail); > } > ========================== Thanks for the report! I think it's better to add the ifsfree() call to the exception handling path as other sh_error calls may trigger this too. function old new delta restore_handler_expandarg - 33 +33 evaltree 725 711 -14 static.redirectsafe 141 124 -17 expandstr 262 242 -20 ------------------------------------------------------------------------------ (add/remove: 1/0 grow/shrink: 0/3 up/down: 36/-45) Total: -18 bytes Signed-off-by: Sanghyun Park Signed-off-by: Denys Vlasenko

ash: only report background jobs in root shell

2026-06-30T16:50:30+00:00

Background jobs were being reported in shells other than an interactive, top-level shell. Suppress this unnecessary report. Adds 16 bytes. Signed-off-by: Ron Yorston

ash: only copy jobtab if needed for job hack

2026-06-30T16:31:20+00:00

This script: #!/bin/bash ( ( true ) & ( true ) & ( true ) & ( true ) & ( true ) & ) resulted in a crash. The problem was introduced by commit 7b692ddf0c (ash: improved support for jobs built-in). This commit copies the job table into child shells for use by the 'jobs' built-in. The crash happens because when the job table is cleared in the child it becomes available for reuse. If only four jobs are required this is OK but going over four causes the table to be reallocated. This doesn't work because in the child it's in shared memory. The fix is not to pass the job table to the child unless it's required by the 'jobs' built-in. This is also more efficient. Adds 0-16 bytes. (GitHub issue #604) Signed-off-by: Ron Yorston

ash: scan drives directly for 'pwd -a'

2026-06-15T11:42:36+00:00

The shell builtin 'pwd' takes a Windows-specific '-a' option to display the current directory on each drive. Use Windows APIs directly to scan for valid drives instead of 'getmntent()'. Future changes will result in 'getmntent()' returning mounted volumes as well as drives. Signed-off-by: Ron Yorston

ash: don't treat process substitutions as background jobs

2026-05-31T14:10:05+00:00

Commit bda604a70 (ash: prevent leakage of process handles) added job tracking for process substitutions. This had the unwanted side-effect that if the user tried to exit from the shell after a command involving process substitution the shell reported that background jobs were present and refused to exit. Use the flag introduced in commit e6c716317 (ash: don't report completion of process substitution) to avoid this. Adds 16 bytes. (GitHub issue #587) Signed-off-by: Ron Yorston

ash: read built-in should respect stty -echo

2026-05-24T18:06:25+00:00

If echo has been disabled by the command 'stty -echo' the shell 'read' built-in should match its behaviour on Linux and not echo keyboard input. Adds 32-48 bytes. (GitHub issue #594) Signed-off-by: Ron Yorston

ash: don't report completion of process substitution

2026-05-17T10:18:32+00:00

Commit bda604a70 (ash: prevent leakage of process handles) added job tracking for process substitutions. This had the unwanted side-effect that the completion of such processes was then reported in interactive shells. Set a flag in such jobs so their completion isn't reported. Adds 32 bytes. (GitHub issue #587)

hush: placate warning: 'print_pfx_escaped_nl' defined but not used

2026-05-14T14:22:40+00:00

Signed-off-by: Denys Vlasenko