ntfs-3g-ntfsprogs: fix CVE-2026-42616

This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [3].

The follow-up in [2] is included to close the opened attribute when
malloc fails and use a common cleanup path for the attribute and
buffer.

[1] https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1
[2] https://github.com/tuxera/ntfs-3g/commit/8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-42616

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-42616_p1.patch

@@ -0,0 +1,70 @@
+From 96f3c15677c6aa0251798eef74a5a4c376523ee3 Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Fri, 24 Apr 2026 12:18:24 +0300
+Subject: [PATCH] ntfscat.c: Fix reading outside the buffer when block size >
+ buffer size.
+
+The block size may be read from the index root's 'index_block_size'
+member, and isn't guaranteed to be >= 4096 (as far as I can tell it
+could be larger). This would for MST protected records lead to storing
+data past the end of the allocated buffer.
+
+Fixed by allocating the necessary amount of buffer space for the case
+when the block size exceeds 4096.
+
+Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this
+issue.
+
+CVE: CVE-2026-42616
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1]
+
+(cherry picked from commit dc1b682e99b6c055b0281ca543a8420b698420d1)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ntfsprogs/ntfscat.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/ntfsprogs/ntfscat.c b/ntfsprogs/ntfscat.c
+index b8af2503..0f711815 100644
+--- a/ntfsprogs/ntfscat.c
++++ b/ntfsprogs/ntfscat.c
+@@ -334,22 +334,17 @@ static int index_get_size(ntfs_inode *inode)
+ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 		ntfschar *name, int namelen)
+ {
+-	const int bufsize = 4096;
+ 	char *buffer;
+ 	ntfs_attr *attr;
+ 	s64 bytes_read, written;
+ 	s64 offset;
+ 	u32 block_size;
+-
+-	buffer = malloc(bufsize);
+-	if (!buffer)
+-		return 1;
++	u32 bufsize = 4096;
+ 
+ 	attr = ntfs_attr_open(inode, type, name, namelen);
+ 	if (!attr) {
+ 		ntfs_log_error("Cannot find attribute type 0x%x.\n",
+ 				le32_to_cpu(type));
+-		free(buffer);
+ 		return 1;
+ 	}
+ 
+@@ -360,6 +355,15 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 	else
+ 		block_size = 0;
+ 
++	if (bufsize < block_size) {
++		bufsize = block_size;
++	}
++
++	buffer = malloc(bufsize);
++	if (!buffer) {
++		return 1;
++	}
++
+ 	offset = 0;
+ 	for (;;) {
+ 		if (!opts.raw && block_size > 0) {

meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-42616_p2.patch

@@ -0,0 +1,79 @@
+From 8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Thu, 20 Aug 2026 15:52:23 +0300
+Subject: [PATCH] ntfscat.c: Fix missing cleanup of opened attribute on malloc
+ error.
+
+Reported as github issue #212. Impact is limited to non-existent as
+'malloc' doesn't fail in modern general-purpose operating systems.
+Additionally even if it does fail, process teardown will clean up any
+remaining resources allocated to the attribute, but it is technically a
+memory leak.
+
+CVE: CVE-2026-42616
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a]
+
+(cherry picked from commit 8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ntfsprogs/ntfscat.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/ntfsprogs/ntfscat.c b/ntfsprogs/ntfscat.c
+index 0f711815..2bf5a2aa 100644
+--- a/ntfsprogs/ntfscat.c
++++ b/ntfsprogs/ntfscat.c
+@@ -334,8 +334,9 @@ static int index_get_size(ntfs_inode *inode)
+ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 		ntfschar *name, int namelen)
+ {
+-	char *buffer;
+-	ntfs_attr *attr;
++	int ret = 0;
++	ntfs_attr *attr = NULL;
++	char *buffer = NULL;
+ 	s64 bytes_read, written;
+ 	s64 offset;
+ 	u32 block_size;
+@@ -345,7 +346,8 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 	if (!attr) {
+ 		ntfs_log_error("Cannot find attribute type 0x%x.\n",
+ 				le32_to_cpu(type));
+-		return 1;
++		ret = 1;
++		goto out;
+ 	}
+ 
+ 	if ((inode->mft_no < 2) && (attr->type == AT_DATA))
+@@ -361,7 +363,8 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 
+ 	buffer = malloc(bufsize);
+ 	if (!buffer) {
+-		return 1;
++		ret = 1;
++		goto out;
+ 	}
+ 
+ 	offset = 0;
+@@ -389,10 +392,14 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 		}
+ 		offset += bytes_read;
+ 	}
+-
+-	ntfs_attr_close(attr);
+-	free(buffer);
+-	return 0;
++out:
++	if (buffer) {
++		free(buffer);
++	}
++	if (attr) {
++		ntfs_attr_close(attr);
++	}
++	return ret;
+ }
+ 
+ /**
+-- 
+2.35.6
+

meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb

@@ -17,6 +17,8 @@ SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV}
            file://CVE-2026-46569.patch \
            file://CVE-2026-42618_p1.patch \
            file://CVE-2026-42618_p2.patch \
+           file://CVE-2026-42616_p1.patch \
+           file://CVE-2026-42616_p2.patch \
 "
 SRCREV = "78414d93613532fd82f3a82aba5d4a1c32898781"