diff options
| -rw-r--r-- | meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch | 42 | ||||
| -rw-r--r-- | meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2026.2.25.bb (renamed from meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb) | 5 |
2 files changed, 2 insertions, 45 deletions
diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch deleted file mode 100644 index 3160f56880..0000000000 --- a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch +++ /dev/null | |||
| @@ -1,42 +0,0 @@ | |||
| 1 | From 7b6210c5be46e5120b42c09f910e8f104bf3edf1 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Erik Larsson <erik@tuxera.com> | ||
| 3 | Date: Tue, 13 Jun 2023 17:47:15 +0300 | ||
| 4 | Subject: [PATCH] unistr.c: Fix use-after-free in 'ntfs_uppercase_mbs'. | ||
| 5 | |||
| 6 | If 'utf8_to_unicode' throws an error due to an invalid UTF-8 sequence, | ||
| 7 | then 'n' will be less than 0 and the loop will terminate without storing | ||
| 8 | anything in '*t'. After the loop the uppercase string's allocation is | ||
| 9 | freed, however after it is freed it is unconditionally accessed through | ||
| 10 | '*t', which points into the freed allocation, for the purpose of NULL- | ||
| 11 | terminating the string. This leads to a use-after-free. | ||
| 12 | Fixed by only NULL-terminating the string when no error has been thrown. | ||
| 13 | |||
| 14 | Thanks for Jeffrey Bencteux for reporting this issue: | ||
| 15 | https://github.com/tuxera/ntfs-3g/issues/84 | ||
| 16 | |||
| 17 | Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/75dcdc2cf37478fad6c0e3427403d198b554951d] | ||
| 18 | CVE: CVE-2023-52890 | ||
| 19 | Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> | ||
| 20 | |||
| 21 | --- | ||
| 22 | libntfs-3g/unistr.c | 3 ++- | ||
| 23 | 1 file changed, 2 insertions(+), 1 deletion(-) | ||
| 24 | |||
| 25 | diff --git a/libntfs-3g/unistr.c b/libntfs-3g/unistr.c | ||
| 26 | index 5854b3b..db8ddf4 100644 | ||
| 27 | --- a/libntfs-3g/unistr.c | ||
| 28 | +++ b/libntfs-3g/unistr.c | ||
| 29 | @@ -1189,8 +1189,9 @@ char *ntfs_uppercase_mbs(const char *low, | ||
| 30 | free(upp); | ||
| 31 | upp = (char*)NULL; | ||
| 32 | errno = EILSEQ; | ||
| 33 | + } else { | ||
| 34 | + *t = 0; | ||
| 35 | } | ||
| 36 | - *t = 0; | ||
| 37 | } | ||
| 38 | return (upp); | ||
| 39 | } | ||
| 40 | -- | ||
| 41 | 2.34.1 | ||
| 42 | |||
diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2026.2.25.bb index 3a7dd783b9..b3193d27b3 100644 --- a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb +++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2026.2.25.bb | |||
| @@ -8,9 +8,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552 \ | |||
| 8 | 8 | ||
| 9 | SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV} \ | 9 | SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV} \ |
| 10 | file://0001-libntfs-3g-Makefile.am-fix-install-failed-while-host.patch \ | 10 | file://0001-libntfs-3g-Makefile.am-fix-install-failed-while-host.patch \ |
| 11 | file://0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch \ | 11 | " |
| 12 | " | 12 | SRCREV = "d1cb9e825d059ef5db0ccd30d5bce202edbd69dc" |
| 13 | SRCREV = "78414d93613532fd82f3a82aba5d4a1c32898781" | ||
| 14 | 13 | ||
| 15 | UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+(\.\d+)+)" | 14 | UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+(\.\d+)+)" |
| 16 | 15 | ||
