From 3b76ade662f34f70074c45601ac1ac3c13950006 Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui3371@sina.com>
Date: Wed, 26 Aug 2026 08:50:08 +0800
Subject: [PATCH] Shell: fixes the fast path of ash version detection

---
 src/detection/terminalshell/terminalshell.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c
index fa323aa9e..4eccf6d49 100644
--- a/src/detection/terminalshell/terminalshell.c
+++ b/src/detection/terminalshell/terminalshell.c
@@ -194,6 +194,9 @@ static bool extractBusyboxVersion(const char* line, uint32_t len, void* userdata
 
 static bool getShellVersionAsh(FFstrbuf* exe, FFstrbuf* version) {
     ffBinaryExtractStrings(exe->chars, extractBusyboxVersion, version, (uint32_t) strlen("BusyBox v0.0.0"));
+    if (version->length > 0) {
+        return true;
+    }
 
     const char* error = ffStrbufEndsWithS(exe, "busybox")
         ? ffProcessAppendStdErr(version, (char* const[]) { exe->chars, "ash", "--help", nullptr })