ntfs-3g-ntfsprogs: fix CVE-2026-42616

This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-42616

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-42616.patch

@@ -0,0 +1,70 @@
+From 96f3c15677c6aa0251798eef74a5a4c376523ee3 Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Fri, 24 Apr 2026 12:18:24 +0300
+Subject: [PATCH] ntfscat.c: Fix reading outside the buffer when block size >
+ buffer size.
+
+The block size may be read from the index root's 'index_block_size'
+member, and isn't guaranteed to be >= 4096 (as far as I can tell it
+could be larger). This would for MST protected records lead to storing
+data past the end of the allocated buffer.
+
+Fixed by allocating the necessary amount of buffer space for the case
+when the block size exceeds 4096.
+
+Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this
+issue.
+
+CVE: CVE-2026-42616
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1]
+
+(cherry picked from commit dc1b682e99b6c055b0281ca543a8420b698420d1)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ntfsprogs/ntfscat.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/ntfsprogs/ntfscat.c b/ntfsprogs/ntfscat.c
+index b8af2503..0f711815 100644
+--- a/ntfsprogs/ntfscat.c
++++ b/ntfsprogs/ntfscat.c
+@@ -334,22 +334,17 @@ static int index_get_size(ntfs_inode *inode)
+ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 		ntfschar *name, int namelen)
+ {
+-	const int bufsize = 4096;
+ 	char *buffer;
+ 	ntfs_attr *attr;
+ 	s64 bytes_read, written;
+ 	s64 offset;
+ 	u32 block_size;
+-
+-	buffer = malloc(bufsize);
+-	if (!buffer)
+-		return 1;
++	u32 bufsize = 4096;
+ 
+ 	attr = ntfs_attr_open(inode, type, name, namelen);
+ 	if (!attr) {
+ 		ntfs_log_error("Cannot find attribute type 0x%x.\n",
+ 				le32_to_cpu(type));
+-		free(buffer);
+ 		return 1;
+ 	}
+ 
+@@ -360,6 +355,15 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 	else
+ 		block_size = 0;
+ 
++	if (bufsize < block_size) {
++		bufsize = block_size;
++	}
++
++	buffer = malloc(bufsize);
++	if (!buffer) {
++		return 1;
++	}
++
+ 	offset = 0;
+ 	for (;;) {
+ 		if (!opts.raw && block_size > 0) {

meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb

@@ -16,6 +16,7 @@ SRC_URI = "http://tuxera.com/opensource/ntfs-3g_ntfsprogs-${PV}.tgz \
            file://CVE-2026-46569.patch \
            file://CVE-2026-42618_p1.patch \
            file://CVE-2026-42618_p2.patch \
+           file://CVE-2026-42616.patch \
 "
 S = "${WORKDIR}/ntfs-3g_ntfsprogs-${PV}"
 SRC_URI[sha256sum] = "f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c"