[rpms/ntfs-3g] epel10.2: Backport upstream fix for CVE-2026-40706

[Carl George <carlwgeorge@gmail.com>]

A new commit has been pushed.

Repo   : rpms/ntfs-3g
Branch : epel10.2
Commit : bdb4c3006ff0eb17339371c6cdba17a802a582f0
Author : Carl George <carlwgeorge@gmail.com>
Date   : 2026-07-15T17:09:59-05:00
Stats  : +61/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/ntfs-3g/c/bdb4c3006ff0eb17339371c6cdba17a802a582f0?branch=epel10.2

Log:
Backport upstream fix for CVE-2026-40706

---
diff --git a/e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e.patch b/e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e.patch
new file mode 100644
index 0000000..c194667
--- /dev/null
+++ b/e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e.patch
@@ -0,0 +1,54 @@
+From e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Tue, 24 Feb 2026 10:04:31 +0200
+Subject: [PATCH] acls.c: Fix heap buffer overflow in
+ 'ntfs_build_permissions_posix'.
+
+The root cause was that the memory allocated for the ACE entries was
+insufficient for the worst case scenario when group entries were added
+for mask entries that didn't have a corresponding group entry already.
+Fixed by allocating space for the worst case number of ACE entries.
+
+This was reported by Andrea Bocchetti with a thorough report which made
+it very easy to fix.
+---
+ libntfs-3g/acls.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/libntfs-3g/acls.c b/libntfs-3g/acls.c
+index 9f16fecd..4cf534bf 100644
+--- a/libntfs-3g/acls.c
++++ b/libntfs-3g/acls.c
+@@ -3716,12 +3716,27 @@ struct POSIX_SECURITY *ntfs_build_permissions_posix(
+ 		/*
+ 		 * Build a raw posix security descriptor
+ 		 * by just translating permissions and ids
+-		 * Add 2 to the count of ACE to be able to insert
+-		 * a group ACE later in access and default ACLs
+-		 * and add 2 more to be able to insert ACEs for owner
+-		 * and 2 more for other
++		 *
++		 * The worst case number of ACE entries consists of:
++		 * - 'acecount' ACE entries from the main loop (see below)
++		 *   iterating over the 'securattr' array.
++		 * - 1 ACE entry which may be added when creating world
++		 *   permissions if none exist.
++		 * - 1 ACE entry which may be added when setting basic owner
++		 *   permissions if none exist (both lists).
++		 * - 1 ACE entry which may be added when duplicating world
++		 *   permissions as group_obj permissions if none exist.
++		 * - 'acecount + 2' ACE entries which may be added when
++		 *   duplicating world permissions as group permissions if they
++		 *   were converted to masks and the masks are not followed by a
++		 *   group entry.
++		 * - 1 ACE entry which may be added when inserting a default
++		 *   mask if none is present and there are designated users or
++		 *   groups.
++		 *
++		 * This amounts to 2*acecnt + 6 ACE entries in the worst case.
+ 		 */
+-	alloccnt = acecnt + 6;
++	alloccnt = 2*acecnt + 6;
+ 	pxdesc = (struct POSIX_SECURITY*)malloc(
+ 				sizeof(struct POSIX_SECURITY)
+ 				+ alloccnt*sizeof(struct POSIX_ACE));

diff --git a/ntfs-3g.spec b/ntfs-3g.spec
index 8424c0c..c601acd 100644
--- a/ntfs-3g.spec
+++ b/ntfs-3g.spec
@@ -8,7 +8,7 @@
 Name:           ntfs-3g
 Epoch:          2
 Version:        2022.10.3
-Release:        9%{?dist}
+Release:        10%{?dist}
 Summary:        Linux NTFS userspace driver
 # Automatically converted from old format: GPLv2+ - review is highly recommended.
 License:        GPL-2.0-or-later
@@ -21,7 +21,10 @@ Patch2:		https://github.com/tuxera/ntfs-3g/commit/01b9bddc0c2165baa46abe7562550e
 Patch3:		https://github.com/tuxera/ntfs-3g/commit/241ddb38605b6b298174e6f1019e8e2502a45558.patch
 Patch4:		https://github.com/tuxera/ntfs-3g/commit/1565b01e215c74e5c5f83f3ecde1ed682637dc5a.patch
 Patch5:		https://github.com/tuxera/ntfs-3g/commit/233658e5a1599e40bbd8211e64bb98a12751b1ea.patch
+# CVE-2023-52890
 Patch6:		https://github.com/tuxera/ntfs-3g/commit/75dcdc2cf37478fad6c0e3427403d198b554951d.patch
+# CVE-2026-40706
+Patch7:         https://github.com/tuxera/ntfs-3g/commit/e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e.patch
 
 BuildRequires:  make
 # ntfs-3g BuildRequires
@@ -200,6 +203,9 @@ rm -rf %{buildroot}%{_defaultdocdir}/%{name}/README
 %exclude %{_mandir}/man8/ntfs-3g*
 
 %changelog
+* Wed Jul 15 2026 Carl George <carlwgeorge@gmail.com> - 2:2022.10.3-10
+- Backport upstream fix for CVE-2026-40706
+
 * Thu Jun  5 2025 Tom Callaway <spot@fedoraproject.org> - 2:2022.10.3-9
 - apply upstream fixes committed after 2022.10.3