user/ntfs-3g: patch for CVE-2019-9755 (#145)

2 files changed, 72 insertions, 3 deletions

diff --git a/user/ntfs-3g/APKBUILD b/user/ntfs-3g/APKBUILD
index d403c4f42..aaa5be24b 100644
--- a/user/ntfs-3g/APKBUILD
+++ b/user/ntfs-3g/APKBUILD
@@ -5,7 +5,7 @@
 pkgname=ntfs-3g
 _pkgname=ntfs-3g_ntfsprogs
 pkgver=2017.3.23
-pkgrel=1
+pkgrel=2
 pkgdesc="Stable, full-featured, read-write NTFS"
 url="https://www.tuxera.com/community/open-source-ntfs-3g/"
 arch="all"
@@ -13,9 +13,14 @@ options="!check"  # No test suite.
 license="LGPL-2.1-only AND BSD-2-Clause AND GPL-2.0+ AND GPL-3.0+"
 makedepends="attr-dev util-linux-dev linux-headers fuse-dev"
 subpackages="$pkgname-doc $pkgname-dev $pkgname-libs"
-source="https://tuxera.com/opensource/$_pkgname-$pkgver.tgz"
+source="https://tuxera.com/opensource/$_pkgname-$pkgver.tgz
+	CVE-2019-9755.patch"
 builddir="$srcdir/$_pkgname-$pkgver"
 
+# secfixes:
+#   2017.3.23-r2:
+#     - CVE-2019-9755
+
 build() {
 	cd "$builddir"
 	./configure \
@@ -37,4 +42,5 @@ package() {
 	ln -s /bin/ntfs-3g "$pkgdir"/sbin/mount.ntfs
 }
 
-sha512sums="3a607f0d7be35204c992d8931de0404fbc52032c13b4240d2c5e6f285c318a28eb2a385d7cf5ac4cd445876aee5baa5753bb636ada0d870d84a9d3fdbce794ef  ntfs-3g_ntfsprogs-2017.3.23.tgz"
+sha512sums="3a607f0d7be35204c992d8931de0404fbc52032c13b4240d2c5e6f285c318a28eb2a385d7cf5ac4cd445876aee5baa5753bb636ada0d870d84a9d3fdbce794ef  ntfs-3g_ntfsprogs-2017.3.23.tgz
+c79ae27e3c9490f0f893a16f27bb19c2cef2fe7b098aabca392163f4105b7ee9797b648d1013ce4c096adf639f6da2b8c43829cfabcc6ac3208c07454a6c0c5c  CVE-2019-9755.patch"
diff --git a/user/ntfs-3g/CVE-2019-9755.patch b/user/ntfs-3g/CVE-2019-9755.patch
new file mode 100644
index 000000000..d1a95541f
--- /dev/null
+++ b/user/ntfs-3g/CVE-2019-9755.patch
@@ -0,0 +1,63 @@
+From 85c1634a26faa572d3c558d4cf8aaaca5202d4e9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jean-Pierre=20Andr=C3=A9?= <jean-pierre.andre@wanadoo.fr>
+Date: Wed, 19 Dec 2018 15:57:50 +0100
+Subject: [PATCH] Fixed reporting an error when failed to build the mountpoint
+
+The size check was inefficient because getcwd() uses an unsigned int
+argument.
+---
+ src/lowntfs-3g.c | 6 +++++-
+ src/ntfs-3g.c    | 6 +++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/lowntfs-3g.c b/src/lowntfs-3g.c
+index 993867fa..0660439b 100644
+--- a/src/lowntfs-3g.c
++++ b/src/lowntfs-3g.c
+@@ -4411,7 +4411,8 @@ int main(int argc, char *argv[])
+ 	else {
+ 		ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX);
+ 		if (ctx->abs_mnt_point) {
+-			if (getcwd(ctx->abs_mnt_point,
++			if ((strlen(opts.mnt_point) < PATH_MAX)
++			    && getcwd(ctx->abs_mnt_point,
+ 				     PATH_MAX - strlen(opts.mnt_point) - 1)) {
+ 				strcat(ctx->abs_mnt_point, "/");
+ 				strcat(ctx->abs_mnt_point, opts.mnt_point);
+@@ -4419,6 +4420,9 @@ int main(int argc, char *argv[])
+ 			/* Solaris also wants the absolute mount point */
+ 				opts.mnt_point = ctx->abs_mnt_point;
+ #endif /* defined(__sun) && defined (__SVR4) */
++			} else {
++				free(ctx->abs_mnt_point);
++				ctx->abs_mnt_point = (char*)NULL;
+ 			}
+ 		}
+ 	}
+diff --git a/src/ntfs-3g.c b/src/ntfs-3g.c
+index 6ce89fef..4e0912ae 100644
+--- a/src/ntfs-3g.c
++++ b/src/ntfs-3g.c
+@@ -4148,7 +4148,8 @@ int main(int argc, char *argv[])
+ 	else {
+ 		ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX);
+ 		if (ctx->abs_mnt_point) {
+-			if (getcwd(ctx->abs_mnt_point,
++			if ((strlen(opts.mnt_point) < PATH_MAX)
++			    && getcwd(ctx->abs_mnt_point,
+ 				     PATH_MAX - strlen(opts.mnt_point) - 1)) {
+ 				strcat(ctx->abs_mnt_point, "/");
+ 				strcat(ctx->abs_mnt_point, opts.mnt_point);
+@@ -4156,6 +4157,9 @@ int main(int argc, char *argv[])
+ 			/* Solaris also wants the absolute mount point */
+ 				opts.mnt_point = ctx->abs_mnt_point;
+ #endif /* defined(__sun) && defined (__SVR4) */
++			} else {
++				free(ctx->abs_mnt_point);
++				ctx->abs_mnt_point = (char*)NULL;
+ 			}
+ 		}
+ 	}
+-- 
+2.22.0
+