ntfs-3g-CVE-2019-9755.patch 1.9 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647
  1. diff -up ntfs-3g_ntfsprogs-2017.3.23/src/lowntfs-3g.c.CVE-2019-9755 ntfs-3g_ntfsprogs-2017.3.23/src/lowntfs-3g.c
  2. --- ntfs-3g_ntfsprogs-2017.3.23/src/lowntfs-3g.c.CVE-2019-9755 2019-03-29 16:08:22.359920075 -0400
  3. +++ ntfs-3g_ntfsprogs-2017.3.23/src/lowntfs-3g.c 2019-03-29 16:08:28.237794169 -0400
  4. @@ -4323,7 +4323,8 @@ int main(int argc, char *argv[])
  5. else {
  6. ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX);
  7. if (ctx->abs_mnt_point) {
  8. - if (getcwd(ctx->abs_mnt_point,
  9. + if ((strlen(opts.mnt_point) < PATH_MAX)
  10. + && getcwd(ctx->abs_mnt_point,
  11. PATH_MAX - strlen(opts.mnt_point) - 1)) {
  12. strcat(ctx->abs_mnt_point, "/");
  13. strcat(ctx->abs_mnt_point, opts.mnt_point);
  14. @@ -4331,6 +4332,9 @@ int main(int argc, char *argv[])
  15. /* Solaris also wants the absolute mount point */
  16. opts.mnt_point = ctx->abs_mnt_point;
  17. #endif /* defined(__sun) && defined (__SVR4) */
  18. + } else {
  19. + free(ctx->abs_mnt_point);
  20. + ctx->abs_mnt_point = (char*)NULL;
  21. }
  22. }
  23. }
  24. diff -up ntfs-3g_ntfsprogs-2017.3.23/src/ntfs-3g.c.CVE-2019-9755 ntfs-3g_ntfsprogs-2017.3.23/src/ntfs-3g.c
  25. --- ntfs-3g_ntfsprogs-2017.3.23/src/ntfs-3g.c.CVE-2019-9755 2019-03-29 16:08:54.691227528 -0400
  26. +++ ntfs-3g_ntfsprogs-2017.3.23/src/ntfs-3g.c 2019-03-29 16:09:40.362249397 -0400
  27. @@ -4123,7 +4123,8 @@ int main(int argc, char *argv[])
  28. else {
  29. ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX);
  30. if (ctx->abs_mnt_point) {
  31. - if (getcwd(ctx->abs_mnt_point,
  32. + if ((strlen(opts.mnt_point) < PATH_MAX)
  33. + && getcwd(ctx->abs_mnt_point,
  34. PATH_MAX - strlen(opts.mnt_point) - 1)) {
  35. strcat(ctx->abs_mnt_point, "/");
  36. strcat(ctx->abs_mnt_point, opts.mnt_point);
  37. @@ -4131,6 +4132,9 @@ int main(int argc, char *argv[])
  38. /* Solaris also wants the absolute mount point */
  39. opts.mnt_point = ctx->abs_mnt_point;
  40. #endif /* defined(__sun) && defined (__SVR4) */
  41. + } else {
  42. + free(ctx->abs_mnt_point);
  43. + ctx->abs_mnt_point = (char*)NULL;
  44. }
  45. }
  46. }