From 2de5fc0267f94bf933f1e52dc8ef348bd3f78059 Mon Sep 17 00:00:00 2001
From: Kei Kebreau
Date: Thu, 9 Feb 2017 16:31:25 -0500
Subject: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.
* gnu/packages/linux.scm (ntfs-3g)[source]: Add patch.
* gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
---
gnu/local.mk | 3 +-
gnu/packages/linux.scm | 1 +
gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch | 42 ++++++++++++++++++++++++
3 files changed, 45 insertions(+), 1 deletion(-)
create mode 100644 gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch
diff --git a/gnu/local.mk b/gnu/local.mk
index 63ce3af71..1fc49bbd6 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -4,7 +4,7 @@
# Copyright © 2016 Mathieu Lirzin
# Copyright © 2013, 2014, 2015, 2016 Mark H Weaver
# Copyright © 2016 Chris Marusich
-# Copyright © 2016 Kei Kebreau
+# Copyright © 2016, 2017 Kei Kebreau
# Copyright © 2016 Rene Saavedra
# Copyright © 2016 Adonay "adfeno" Felipe Nogueira
# Copyright © 2016, 2017 Ricardo Wurmus
@@ -777,6 +777,7 @@ dist_patch_DATA = \
%D%/packages/patches/ninja-zero-mtime.patch \
%D%/packages/patches/node-9077.patch \
%D%/packages/patches/nss-pkgconfig.patch \
+ %D%/packages/patches/ntfs-3g-CVE-2017-0358.patch \
%D%/packages/patches/nvi-assume-preserve-path.patch \
%D%/packages/patches/nvi-dbpagesize-binpower.patch \
%D%/packages/patches/nvi-db4.patch \
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index dc4d37920..f918680c3 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -2906,6 +2906,7 @@ from userspace.")
(base32
"180y5y09h30ryf2vim8j30a2npwz1iv9ly5yjmh3wjdkwh2jrdyp"))
(modules '((guix build utils)))
+ (patches (search-patches "ntfs-3g-CVE-2017-0358.patch"))
(snippet
;; Install under $prefix.
'(substitute* '("src/Makefile.in" "ntfsprogs/Makefile.in")
diff --git a/gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch b/gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch
new file mode 100644
index 000000000..e09e39ed8
--- /dev/null
+++ b/gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch
@@ -0,0 +1,42 @@
+Fix CVE-2017-0358:
+http://seclists.org/oss-sec/2017/q1/259
+This patch was copied from the above URL.
+
+diff -ur ntfs-3g.old/src/lowntfs-3g.c ntfs-3g/src/lowntfs-3g.c
+--- ntfs-3g.old/src/lowntfs-3g.c 2017-02-09 15:01:04.074331542 -0500
++++ ntfs-3g/src/lowntfs-3g.c 2017-02-09 15:06:35.757580937 -0500
+@@ -3827,13 +3827,14 @@
+ struct stat st;
+ pid_t pid;
+ const char *cmd = "/sbin/modprobe";
++ char *env = (char*)NULL;
+ struct timespec req = { 0, 100000000 }; /* 100 msec */
+ fuse_fstype fstype;
+
+ if (!stat(cmd, &st) && !geteuid()) {
+ pid = fork();
+ if (!pid) {
+- execl(cmd, cmd, "fuse", NULL);
++ execle(cmd, cmd, "fuse", NULL, &env);
+ _exit(1);
+ } else if (pid != -1)
+ waitpid(pid, NULL, 0);
+diff -ur ntfs-3g.old/src/ntfs-3g.c ntfs-3g/src/ntfs-3g.c
+--- ntfs-3g.old/src/ntfs-3g.c 2017-02-09 15:01:04.074331542 -0500
++++ ntfs-3g/src/ntfs-3g.c 2017-02-09 15:06:26.077252571 -0500
+@@ -3612,13 +3612,14 @@
+ struct stat st;
+ pid_t pid;
+ const char *cmd = "/sbin/modprobe";
++ char *env = (char*)NULL;
+ struct timespec req = { 0, 100000000 }; /* 100 msec */
+ fuse_fstype fstype;
+
+ if (!stat(cmd, &st) && !geteuid()) {
+ pid = fork();
+ if (!pid) {
+- execl(cmd, cmd, "fuse", NULL);
++ execle(cmd, cmd, "fuse", NULL, &env);
+ _exit(1);
+ } else if (pid != -1)
+ waitpid(pid, NULL, 0);
--
2.11.1