From 723552f68ba79e2a20c9896b114f67dab3c9d61d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Wed, 3 Jun 2026 18:29:10 +0800
Subject: [PATCH] Shell: be more robust on busybox version detection

---
 src/detection/terminalshell/terminalshell.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c
index e4b83f37a..222221660 100644
--- a/src/detection/terminalshell/terminalshell.c
+++ b/src/detection/terminalshell/terminalshell.c
@@ -173,7 +173,14 @@ static bool extractBusyboxVersion(const char* line, uint32_t len, void* userdata
         return true;
     }
 
-    ffStrbufSetNS((FFstrbuf*) userdata, len - strlen("BusyBox v"), line + strlen("BusyBox v"));
+    line += strlen("BusyBox v");
+    len -= (uint32_t) strlen("BusyBox v");
+    const char* space = memchr(line, ' ', len);
+    if (space) {
+        len = (uint32_t) (space - line);
+    }
+
+    ffStrbufSetNS((FFstrbuf*) userdata, len, line);
     return false;
 }