Patch ntfs-3g for CVE-2026-42616, CVE-2026-42617, CVE-2026-42618, CVE-2026-46569, CVE-2026-46570, CVE-2026-46571

SPECS/ntfs-3g/CVE-2026-42616.patch

@@ -0,0 +1,57 @@
+From 1dba3eea6dc0965cfef8c6f60ce7e6248bac836a Mon Sep 17 00:00:00 2001
+From: jykanase <v-jykanase@microsoft.com>
+Date: Thu, 10 Sep 2026 08:10:27 +0000
+Subject: [PATCH] CVE-2026-42616.patch
+
+Upstream Patch Reference: https://github.com/user-attachments/files/29754085/ntfs-3g_2022.10.3-cve_2026-04_2.patch
+---
+ ntfsprogs/ntfscat.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/ntfsprogs/ntfscat.c b/ntfsprogs/ntfscat.c
+index b8af250..0f71181 100644
+--- a/ntfsprogs/ntfscat.c
++++ b/ntfsprogs/ntfscat.c
+@@ -334,22 +334,17 @@ static int index_get_size(ntfs_inode *inode)
+ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 		ntfschar *name, int namelen)
+ {
+-	const int bufsize = 4096;
+ 	char *buffer;
+ 	ntfs_attr *attr;
+ 	s64 bytes_read, written;
+ 	s64 offset;
+ 	u32 block_size;
+-
+-	buffer = malloc(bufsize);
+-	if (!buffer)
+-		return 1;
++	u32 bufsize = 4096;
+
+ 	attr = ntfs_attr_open(inode, type, name, namelen);
+ 	if (!attr) {
+ 		ntfs_log_error("Cannot find attribute type 0x%x.\n",
+ 				le32_to_cpu(type));
+-		free(buffer);
+ 		return 1;
+ 	}
+
+@@ -360,6 +355,15 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ 	else
+ 		block_size = 0;
+
++	if (bufsize < block_size) {
++		bufsize = block_size;
++	}
++
++	buffer = malloc(bufsize);
++	if (!buffer) {
++		return 1;
++	}
++
+ 	offset = 0;
+ 	for (;;) {
+ 		if (!opts.raw && block_size > 0) {
+-- 
+2.45.4
+

SPECS/ntfs-3g/CVE-2026-42617.patch

@@ -0,0 +1,145 @@
+From 3de37d7e11741124a2f4f1f203670b56b3309748 Mon Sep 17 00:00:00 2001
+From: jykanase <v-jykanase@microsoft.com>
+Date: Thu, 10 Sep 2026 08:14:06 +0000
+Subject: [PATCH] CVE-2026-42617
+
+Upstream Patch Reference: https://github.com/user-attachments/files/29754124/ntfs-3g_2022.10.3-cve_2026-04_3.patch
+---
+ include/ntfs-3g/index.h |  1 +
+ libntfs-3g/attrib.c     |  7 ++++++
+ libntfs-3g/index.c      | 55 ++++++++++++++++++++++++++++++++++++++---
+ 3 files changed, 60 insertions(+), 3 deletions(-)
+
+diff --git a/include/ntfs-3g/index.h b/include/ntfs-3g/index.h
+index d001863..1d5845d 100644
+--- a/include/ntfs-3g/index.h
++++ b/include/ntfs-3g/index.h
+@@ -143,6 +143,7 @@ extern int ntfs_index_block_inconsistent(const INDEX_BLOCK *ib, u32 block_size,
+ 			u64 inum, VCN vcn);
+ extern int ntfs_index_entry_inconsistent(const INDEX_ENTRY *ie,
+ 			COLLATION_RULES collation_rule, u64 inum);
++extern int ntfs_ie_stream_inconsistent(const INDEX_HEADER *ih, u64 inum);
+ extern int ntfs_index_lookup(const void *key, const int key_len,
+ 		ntfs_index_context *ictx) __attribute_warn_unused_result__;
+
+diff --git a/libntfs-3g/attrib.c b/libntfs-3g/attrib.c
+index efb9194..cfc2446 100644
+--- a/libntfs-3g/attrib.c
++++ b/libntfs-3g/attrib.c
+@@ -3528,6 +3528,10 @@ int ntfs_attr_inconsistent(const ATTR_RECORD *a, const MFT_REF mref)
+ 			if (a->non_resident
+ 			    || (le32_to_cpu(a->value_length)
+ 				< offsetof(INDEX_ROOT, index.reserved))
++			    || (le32_to_cpu(ir->index_block_size)
++				< NTFS_BLOCK_SIZE)
++			    || (le32_to_cpu(ir->index_block_size)
++				& (le32_to_cpu(ir->index_block_size) - 1))
+ 			    || (le32_to_cpu(ir->index.entries_offset)
+ 				< sizeof(INDEX_HEADER))
+ 			    || (le32_to_cpu(ir->index.index_length)
+@@ -3542,6 +3546,9 @@ int ntfs_attr_inconsistent(const ATTR_RECORD *a, const MFT_REF mref)
+ 					(long long)inum);
+ 				errno = EIO;
+ 				ret = -1;
++			} else if (ntfs_ie_stream_inconsistent(&ir->index, inum)) {
++				errno = EIO;
++				ret = -1;
+ 			}
+ 			break;
+ 		case AT_STANDARD_INFORMATION :
+diff --git a/libntfs-3g/index.c b/libntfs-3g/index.c
+index e48d6aa..c9651a6 100644
+--- a/libntfs-3g/index.c
++++ b/libntfs-3g/index.c
+@@ -504,6 +504,8 @@ int ntfs_index_block_inconsistent(const INDEX_BLOCK *ib, u32 block_size,
+ 				(unsigned long long)inum);
+ 		return -1;
+ 	}
++	if (ntfs_ie_stream_inconsistent(&ib->index, inum))
++		return -1;
+
+ 	return (0);
+ }
+@@ -560,7 +562,40 @@ int ntfs_index_entry_inconsistent(const INDEX_ENTRY *ie,
+ 	return (ret);
+ }
+
+-/** 
++int ntfs_ie_stream_inconsistent(const INDEX_HEADER *ih, u64 inum)
++{
++	const u8 *ies_start = (const u8 *)ih + le32_to_cpu(ih->entries_offset);
++	const u8 *ies_end = (const u8 *)ih + le32_to_cpu(ih->index_length);
++	const u8 *ie;
++
++	ntfs_log_trace("Entering\n");
++
++	for (ie = ies_start; ie < ies_end; ) {
++		u32 len;
++		const INDEX_ENTRY *ent = (const INDEX_ENTRY *)ie;
++
++		if ((size_t)(ies_end - ie) < sizeof(INDEX_ENTRY_HEADER))
++			goto err;
++		len = le16_to_cpu(ent->length);
++		if (len < sizeof(INDEX_ENTRY_HEADER) || (len & 7))
++			goto err;
++		if ((size_t)(ies_end - ie) < len)
++			goto err;
++		if (ent->ie_flags & INDEX_ENTRY_END) {
++			/* END must terminate the stream exactly. */
++			if (ie + len != ies_end)
++				goto err;
++			return 0;
++		}
++		ie += len;
++	}
++err:
++	ntfs_log_error("Corrupt index entry stream in inode %lld\n",
++			(long long)inum);
++	return -1;
++}
++
++/**
+  * Find a key in the index block.
+  * 
+  * Return values:
+@@ -1091,14 +1126,16 @@ out:
+
+ static INDEX_BLOCK *ntfs_ir_to_ib(INDEX_ROOT *ir, VCN ib_vcn)
+ {
++	u32 ib_size;
+ 	INDEX_BLOCK *ib;
+ 	INDEX_ENTRY *ie_last;
+ 	char *ies_start, *ies_end;
+ 	int i;
+
+ 	ntfs_log_trace("Entering\n");
+-	
+-	ib = ntfs_ib_alloc(ib_vcn, le32_to_cpu(ir->index_block_size), LEAF_NODE);
++
++	ib_size = le32_to_cpu(ir->index_block_size);
++	ib = ntfs_ib_alloc(ib_vcn, ib_size, LEAF_NODE);
+ 	if (!ib)
+ 		return NULL;
+
+@@ -1110,6 +1147,18 @@ static INDEX_BLOCK *ntfs_ir_to_ib(INDEX_ROOT *ir, VCN ib_vcn)
+ 	 * as well, which can never have any data.
+ 	 */
+ 	i = (char *)ie_last - ies_start + le16_to_cpu(ie_last->length);
++
++	if (offsetof(INDEX_BLOCK, index) + le32_to_cpu(ib->index.entries_offset)
++			+ i > ib_size)
++	{
++		ntfs_log_error("Last entry in index root overflows the index "
++				"block size: %d (index block size: %lu)\n",
++				i, (unsigned long)ib_size);
++		free(ib);
++		errno = EIO;
++		return NULL;
++	}
++
+ 	memcpy(ntfs_ie_get_first(&ib->index), ies_start, i);
+
+ 	ib->index.ih_flags = ir->index.ih_flags;
+-- 
+2.45.4
+