diff --git a/make/target-tools.mk b/make/target-tools.mk index 0060c936..0a49fff2 100644 --- a/make/target-tools.mk +++ b/make/target-tools.mk @@ -361,7 +361,10 @@ ntfs-3g: $(NTFS-3G_DEPS) $(DL_DIR)/$(NTFS-3G_SOURCE) | $(TARGET_DIR) $(REMOVE)/$(NTFS-3G_DIR) $(UNTAR)/$(NTFS-3G_SOURCE) $(CHDIR)/$(NTFS-3G_DIR); \ + $(APPLY_PATCHES); \ $(CONFIGURE) \ + --program-prefix= \ + --program-suffix= \ --prefix=$(prefix) \ --bindir=$(base_bindir) \ --sbindir=$(base_sbindir) \ @@ -376,7 +379,7 @@ ntfs-3g: $(NTFS-3G_DEPS) $(DL_DIR)/$(NTFS-3G_SOURCE) | $(TARGET_DIR) $(MAKE) install DESTDIR=$(TARGET_DIR) -rm $(addprefix $(TARGET_base_bindir)/,lowntfs-3g ntfs-3g.probe) -rm $(addprefix $(TARGET_base_sbindir)/,mount.lowntfs-3g) - ln -sf ntfs-3g $(TARGET_base_sbindir)/mount.ntfs + ln -sf $(base_bindir)/ntfs-3g $(TARGET_base_sbindir)/mount.ntfs $(REMOVE)/$(NTFS-3G_DIR) $(TOUCH) diff --git a/patches/ntfs-3g/0001-Fixed-reporting-an-error-when-failed-to-build-the-mo.patch b/patches/ntfs-3g/0001-Fixed-reporting-an-error-when-failed-to-build-the-mo.patch new file mode 100644 index 00000000..9ba8aae5 --- /dev/null +++ b/patches/ntfs-3g/0001-Fixed-reporting-an-error-when-failed-to-build-the-mo.patch @@ -0,0 +1,72 @@ +From 85c1634a26faa572d3c558d4cf8aaaca5202d4e9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jean-Pierre=20Andr=C3=A9?= +Date: Wed, 19 Dec 2018 15:57:50 +0100 +Subject: [PATCH] Fixed reporting an error when failed to build the mountpoint + +The size check was inefficient because getcwd() uses an unsigned int +argument. + +Fixes CVE-2019-9755: An integer underflow issue exists in ntfs-3g 2017.3.23. +A local attacker could potentially exploit this by running /bin/ntfs-3g with +specially crafted arguments from a specially crafted directory to cause a +heap buffer overflow, resulting in a crash or the ability to execute +arbitrary code. In installations where /bin/ntfs-3g is a setuid-root +binary, this could lead to a local escalation of privileges. + +Signed-off-by: Peter Korsgaard +--- + src/lowntfs-3g.c | 6 +++++- + src/ntfs-3g.c | 6 +++++- + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/lowntfs-3g.c b/src/lowntfs-3g.c +index 993867fa..0660439b 100644 +--- a/src/lowntfs-3g.c ++++ b/src/lowntfs-3g.c +@@ -4411,7 +4411,8 @@ int main(int argc, char *argv[]) + else { + ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX); + if (ctx->abs_mnt_point) { +- if (getcwd(ctx->abs_mnt_point, ++ if ((strlen(opts.mnt_point) < PATH_MAX) ++ && getcwd(ctx->abs_mnt_point, + PATH_MAX - strlen(opts.mnt_point) - 1)) { + strcat(ctx->abs_mnt_point, "/"); + strcat(ctx->abs_mnt_point, opts.mnt_point); +@@ -4419,6 +4420,9 @@ int main(int argc, char *argv[]) + /* Solaris also wants the absolute mount point */ + opts.mnt_point = ctx->abs_mnt_point; + #endif /* defined(__sun) && defined (__SVR4) */ ++ } else { ++ free(ctx->abs_mnt_point); ++ ctx->abs_mnt_point = (char*)NULL; + } + } + } +diff --git a/src/ntfs-3g.c b/src/ntfs-3g.c +index 6ce89fef..4e0912ae 100644 +--- a/src/ntfs-3g.c ++++ b/src/ntfs-3g.c +@@ -4148,7 +4148,8 @@ int main(int argc, char *argv[]) + else { + ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX); + if (ctx->abs_mnt_point) { +- if (getcwd(ctx->abs_mnt_point, ++ if ((strlen(opts.mnt_point) < PATH_MAX) ++ && getcwd(ctx->abs_mnt_point, + PATH_MAX - strlen(opts.mnt_point) - 1)) { + strcat(ctx->abs_mnt_point, "/"); + strcat(ctx->abs_mnt_point, opts.mnt_point); +@@ -4156,6 +4157,9 @@ int main(int argc, char *argv[]) + /* Solaris also wants the absolute mount point */ + opts.mnt_point = ctx->abs_mnt_point; + #endif /* defined(__sun) && defined (__SVR4) */ ++ } else { ++ free(ctx->abs_mnt_point); ++ ctx->abs_mnt_point = (char*)NULL; + } + } + } +-- +2.20.1 +