mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-05-08 05:29:22 +00:00
ntfs-3g-ntfsprogs: upgrade 2022.10.3 -> 2026.2.25
0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch removed since it's included in 2026.2.25 Changes: =========== - Fix bashism in configure script causing errors in non-bash shells. - (mkntfs) Enable microsecond-level volume creation time. - Fix two instances of an invalid errno state when encountering NULL in strings. - Fix a crash when a reparse tag could not be found in the index. - Fix incorrect MFT free records value when bitmap is expanded. - Fix 'extras' manpages being installed when extras are disabled. - Fix various instances of use-after-free conditions in the library and tools. - Fix typo in NTFS hibernation message. Thanks to Anil Kumar for the report/fix. - Escape commas in the fsname when libfuse 2.8 or higher is used. - (ntfsclone) Allow adjusting the sector size in the NTFS boot sector for the target device when restoring images. - Remove libdl dependency when building without external plugins. - (ntfsinfo) Show information about the logfile state when dumping metadata. - (ntfsinfo) Fix displaying crowded directories or indexes. - (ntfsinfo) Fix displaying the security descriptor list in ntfsinfo. - Fix heap buffer overflow when POSIX ACLs were enabled (CVE-2026-40706). Thanks to Andrea Bocchetti for the report. - (ntfsusermap) Fix overflow when constructing backup filename. - Fix two time-of-check-time-of-use conditions. - Fix missing malloc/sscanf return value checks. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
-42
@@ -1,42 +0,0 @@
|
||||
From 7b6210c5be46e5120b42c09f910e8f104bf3edf1 Mon Sep 17 00:00:00 2001
|
||||
From: Erik Larsson <erik@tuxera.com>
|
||||
Date: Tue, 13 Jun 2023 17:47:15 +0300
|
||||
Subject: [PATCH] unistr.c: Fix use-after-free in 'ntfs_uppercase_mbs'.
|
||||
|
||||
If 'utf8_to_unicode' throws an error due to an invalid UTF-8 sequence,
|
||||
then 'n' will be less than 0 and the loop will terminate without storing
|
||||
anything in '*t'. After the loop the uppercase string's allocation is
|
||||
freed, however after it is freed it is unconditionally accessed through
|
||||
'*t', which points into the freed allocation, for the purpose of NULL-
|
||||
terminating the string. This leads to a use-after-free.
|
||||
Fixed by only NULL-terminating the string when no error has been thrown.
|
||||
|
||||
Thanks for Jeffrey Bencteux for reporting this issue:
|
||||
https://github.com/tuxera/ntfs-3g/issues/84
|
||||
|
||||
Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/75dcdc2cf37478fad6c0e3427403d198b554951d]
|
||||
CVE: CVE-2023-52890
|
||||
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
||||
|
||||
---
|
||||
libntfs-3g/unistr.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libntfs-3g/unistr.c b/libntfs-3g/unistr.c
|
||||
index 5854b3b..db8ddf4 100644
|
||||
--- a/libntfs-3g/unistr.c
|
||||
+++ b/libntfs-3g/unistr.c
|
||||
@@ -1189,8 +1189,9 @@ char *ntfs_uppercase_mbs(const char *low,
|
||||
free(upp);
|
||||
upp = (char*)NULL;
|
||||
errno = EILSEQ;
|
||||
+ } else {
|
||||
+ *t = 0;
|
||||
}
|
||||
- *t = 0;
|
||||
}
|
||||
return (upp);
|
||||
}
|
||||
--
|
||||
2.34.1
|
||||
|
||||
+2
-3
@@ -8,9 +8,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552 \
|
||||
|
||||
SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV} \
|
||||
file://0001-libntfs-3g-Makefile.am-fix-install-failed-while-host.patch \
|
||||
file://0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch \
|
||||
"
|
||||
SRCREV = "78414d93613532fd82f3a82aba5d4a1c32898781"
|
||||
"
|
||||
SRCREV = "d1cb9e825d059ef5db0ccd30d5bce202edbd69dc"
|
||||
|
||||
UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+(\.\d+)+)"
|
||||
|
||||
Reference in New Issue
Block a user