[notify] ntfs-3g: apply fix for CVE-2019-9755

9 files changed, 640 insertions, 14 deletions

diff --git a/ntfs-3g/.footprint b/ntfs-3g/.footprint
index 8a8ff873c..eb9b9d1ac 100644
--- a/ntfs-3g/.footprint
+++ b/ntfs-3g/.footprint
@@ -1,18 +1,14 @@
-drwxr-xr-x	root/root	bin/
--rwxr-xr-x	root/root	bin/lowntfs-3g
--rwxr-xr-x	root/root	bin/ntfs-3g
 drwxr-xr-x	root/root	lib/
-lrwxrwxrwx	root/root	lib/libntfs-3g.so -> libntfs-3g.so.88.0.0
-lrwxrwxrwx	root/root	lib/libntfs-3g.so.88 -> libntfs-3g.so.88.0.0
--rwxr-xr-x	root/root	lib/libntfs-3g.so.88.0.0
 drwxr-xr-x	root/root	sbin/
 lrwxrwxrwx	root/root	sbin/fsck.ntfs -> ../usr/bin/ntfsfix
 lrwxrwxrwx	root/root	sbin/mkfs.ntfs -> /usr/sbin/mkntfs
-lrwxrwxrwx	root/root	sbin/mount.lowntfs-3g -> /bin/lowntfs-3g
+lrwxrwxrwx	root/root	sbin/mount.lowntfs-3g -> /usr/bin/lowntfs-3g
 lrwxrwxrwx	root/root	sbin/mount.ntfs -> ../bin/ntfs-3g
-lrwxrwxrwx	root/root	sbin/mount.ntfs-3g -> /bin/ntfs-3g
+lrwxrwxrwx	root/root	sbin/mount.ntfs-3g -> /usr/bin/ntfs-3g
 drwxr-xr-x	root/root	usr/
 drwxr-xr-x	root/root	usr/bin/
+-rwxr-xr-x	root/root	usr/bin/lowntfs-3g
+-rwxr-xr-x	root/root	usr/bin/ntfs-3g
 -rwxr-xr-x	root/root	usr/bin/ntfs-3g.probe
 -rwxr-xr-x	root/root	usr/bin/ntfscat
 -rwxr-xr-x	root/root	usr/bin/ntfscluster
@@ -69,7 +65,9 @@ drwxr-xr-x	root/root	usr/include/ntfs-3g/
 drwxr-xr-x	root/root	usr/lib/
 -rw-r--r--	root/root	usr/lib/libntfs-3g.a
 -rwxr-xr-x	root/root	usr/lib/libntfs-3g.la
-lrwxrwxrwx	root/root	usr/lib/libntfs-3g.so -> /lib/libntfs-3g.so
+lrwxrwxrwx	root/root	usr/lib/libntfs-3g.so -> libntfs-3g.so.88.0.0
+lrwxrwxrwx	root/root	usr/lib/libntfs-3g.so.88 -> libntfs-3g.so.88.0.0
+-rwxr-xr-x	root/root	usr/lib/libntfs-3g.so.88.0.0
 drwxr-xr-x	root/root	usr/lib/ntfs-3g/
 drwxr-xr-x	root/root	usr/lib/pkgconfig/
 -rw-r--r--	root/root	usr/lib/pkgconfig/libntfs-3g.pc
diff --git a/ntfs-3g/.signature b/ntfs-3g/.signature
index cb55b42b9..c0ba68801 100644
--- a/ntfs-3g/.signature
+++ b/ntfs-3g/.signature
@@ -1,5 +1,11 @@
 untrusted comment: verify with /etc/ports/contrib.pub
-RWSagIOpLGJF36+0POtx/honfKGrgHQXZp4VFa9CWs7e1ihJl9XyLVj6FtUT5G/AKy9uWhutGcJM4+q5r+uVgtDUKn/STKs+xQw=
-SHA256 (Pkgfile) = 695c0054561051aa43375b2e83933353b23c3e8a5be82871ab5b32e27826c153
-SHA256 (.footprint) = 54022ff9296f3929e5a2dd4856246a0e6d4a505eb27df38e15c6da82da1ae504
+RWSagIOpLGJF342d8FZgT0XXcMQkT7SNqKUVwdMSjasIG1V/xhaNMdUyxj3EQbSR4coCYHJ/4lwbW6zoes8UyuBtQcWWGC4EdwA=
+SHA256 (Pkgfile) = 79dd830e54ba4d291cbfcb2034a78cf9255e29b0d164fb7aeb44ef5cc348bb8b
+SHA256 (.footprint) = 5f7e4c1531b164199ced4d56b2ba142bd34bc45be1c3b0f96ffce7bf2908b37d
 SHA256 (ntfs-3g_ntfsprogs-2017.3.23.tgz) = 3e5a021d7b761261836dcb305370af299793eedbded731df3d6943802e1262d5
+SHA256 (ntfs3g-2014.2.15-no-split-usr.patch) = 3fdd9b2947e1ded82258a86d55d481d641613d8ff916f6eeacc6c0e68042beb8
+SHA256 (ntfs3g-2016.2.22-sysmacros.patch) = 9d9ed593acd23f01b2a862a86691d953253976c962e8b8cd52884bef86a2d342
+SHA256 (ntfs3g-2017.3.23-check-mftmirr.patch) = 479b6e9f5efb0d7029031bef5c504acd9762dd9674f1dbfcf12c3064e6d4f524
+SHA256 (ntfs3g-2017.3.23-big-sectors.patch) = f15c294cce26c813ab933291509d25d6bead87a99d75482bc4e28a2a8338a569
+SHA256 (ntfs3g-2017.3.23-full-clusters.patch) = 9b37edba1b1ec6fa5040626426d62494b1e36ea6419e748a25014707cce6abb4
+SHA256 (CVE-2019-9755.patch) = a1d400c2fa5c72328050056e3fac6d150b2b70527ae3200164cb157132880fd1
diff --git a/ntfs-3g/CVE-2019-9755.patch b/ntfs-3g/CVE-2019-9755.patch
new file mode 100644
index 000000000..caa079d60
--- /dev/null
+++ b/ntfs-3g/CVE-2019-9755.patch
@@ -0,0 +1,63 @@
+From 85c1634a26faa572d3c558d4cf8aaaca5202d4e9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jean-Pierre=20Andr=C3=A9?= <jean-pierre.andre@wanadoo.fr>
+Date: Wed, 19 Dec 2018 15:57:50 +0100
+Subject: [PATCH] Fixed reporting an error when failed to build the mountpoint
+
+The size check was inefficient because getcwd() uses an unsigned int
+argument.
+---
+ src/lowntfs-3g.c | 6 +++++-
+ src/ntfs-3g.c    | 6 +++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/lowntfs-3g.c b/src/lowntfs-3g.c
+index 993867fa..0660439b 100644
+--- a/src/lowntfs-3g.c
++++ b/src/lowntfs-3g.c
+@@ -4411,7 +4411,8 @@ int main(int argc, char *argv[])
+ 	else {
+ 		ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX);
+ 		if (ctx->abs_mnt_point) {
+-			if (getcwd(ctx->abs_mnt_point,
++			if ((strlen(opts.mnt_point) < PATH_MAX)
++			    && getcwd(ctx->abs_mnt_point,
+ 				     PATH_MAX - strlen(opts.mnt_point) - 1)) {
+ 				strcat(ctx->abs_mnt_point, "/");
+ 				strcat(ctx->abs_mnt_point, opts.mnt_point);
+@@ -4419,6 +4420,9 @@ int main(int argc, char *argv[])
+ 			/* Solaris also wants the absolute mount point */
+ 				opts.mnt_point = ctx->abs_mnt_point;
+ #endif /* defined(__sun) && defined (__SVR4) */
++			} else {
++				free(ctx->abs_mnt_point);
++				ctx->abs_mnt_point = (char*)NULL;
+ 			}
+ 		}
+ 	}
+diff --git a/src/ntfs-3g.c b/src/ntfs-3g.c
+index 6ce89fef..4e0912ae 100644
+--- a/src/ntfs-3g.c
++++ b/src/ntfs-3g.c
+@@ -4148,7 +4148,8 @@ int main(int argc, char *argv[])
+ 	else {
+ 		ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX);
+ 		if (ctx->abs_mnt_point) {
+-			if (getcwd(ctx->abs_mnt_point,
++			if ((strlen(opts.mnt_point) < PATH_MAX)
++			    && getcwd(ctx->abs_mnt_point,
+ 				     PATH_MAX - strlen(opts.mnt_point) - 1)) {
+ 				strcat(ctx->abs_mnt_point, "/");
+ 				strcat(ctx->abs_mnt_point, opts.mnt_point);
+@@ -4156,6 +4157,9 @@ int main(int argc, char *argv[])
+ 			/* Solaris also wants the absolute mount point */
+ 				opts.mnt_point = ctx->abs_mnt_point;
+ #endif /* defined(__sun) && defined (__SVR4) */
++			} else {
++				free(ctx->abs_mnt_point);
++				ctx->abs_mnt_point = (char*)NULL;
+ 			}
+ 		}
+ 	}
+-- 
+2.26.1
+
diff --git a/ntfs-3g/Pkgfile b/ntfs-3g/Pkgfile
index 271fe6d3e..1cb1c4f61 100644
--- a/ntfs-3g/Pkgfile
+++ b/ntfs-3g/Pkgfile
@@ -5,20 +5,39 @@
 
 name=ntfs-3g
 version=2017.3.23
-release=1
-source=(https://tuxera.com/opensource/ntfs-3g_ntfsprogs-$version.tgz)
+release=2
+source=(https://tuxera.com/opensource/ntfs-3g_ntfsprogs-$version.tgz
+	ntfs3g-2014.2.15-no-split-usr.patch
+	ntfs3g-2016.2.22-sysmacros.patch
+	ntfs3g-2017.3.23-check-mftmirr.patch
+	ntfs3g-2017.3.23-big-sectors.patch
+	ntfs3g-2017.3.23-full-clusters.patch
+	CVE-2019-9755.patch)
 
 build() {
 	cd ntfs-3g_ntfsprogs-$version
 
+	patch -p1 -i $SRC/ntfs3g-2014.2.15-no-split-usr.patch
+	patch -p1 -i $SRC/ntfs3g-2016.2.22-sysmacros.patch
+	patch -p1 -i $SRC/ntfs3g-2017.3.23-check-mftmirr.patch
+	patch -p1 -i $SRC/ntfs3g-2017.3.23-big-sectors.patch
+	patch -p1 -i $SRC/ntfs3g-2017.3.23-full-clusters.patch
+	patch -p1 -i $SRC/CVE-2019-9755.patch
+
 	install -d $PKG/lib
 
 	./configure \
 		--prefix=/usr \
+		--exec-prefix=/usr \
+		--enable-ldscript \
 		--disable-ldconfig \
 		--with-fuse=external \
 		--enable-posix-acls \
+		--enable-xattr-mappings \
+		--without-uuid \
+		--without-hd \
 		--enable-extras
+		#--enable-crypto
 
 	make
 	make DESTDIR=$PKG install
diff --git a/ntfs-3g/ntfs3g-2014.2.15-no-split-usr.patch b/ntfs-3g/ntfs3g-2014.2.15-no-split-usr.patch
new file mode 100644
index 000000000..0228bfec3
--- /dev/null
+++ b/ntfs-3g/ntfs3g-2014.2.15-no-split-usr.patch
@@ -0,0 +1,25 @@
+we handle split /usr logic ourselves.  this ends up breaking when building
+for an abi that doesn't exist in / (like cross-compiling) as the tests fail.
+
+--- a/libntfs-3g/Makefile.in
++++ b/libntfs-3g/Makefile.in
+@@ -912,19 +912,6 @@ uninstall-am: uninstall-libLTLIBRARIES uninstall-local \
+ 	uninstall-rootlibLTLIBRARIES
+ 
+ 
+-# We may need to move .so files to root
+-# And create ldscript or symbolic link from /usr
+-install-exec-hook: install-rootlibLTLIBRARIES
+-@INSTALL_LIBRARY_TRUE@	if [ ! "$(rootlibdir)" -ef "$(libdir)" ]; then \
+-@INSTALL_LIBRARY_TRUE@		$(MV) -f "$(DESTDIR)/$(libdir)"/libntfs-3g.so* "$(DESTDIR)/$(rootlibdir)";  \
+-@INSTALL_LIBRARY_TRUE@	fi
+-@GENERATE_LDSCRIPT_TRUE@@INSTALL_LIBRARY_TRUE@	if [ ! "$(rootlibdir)" -ef "$(libdir)" ]; then \
+-@GENERATE_LDSCRIPT_TRUE@@INSTALL_LIBRARY_TRUE@		$(install_sh_PROGRAM) "libntfs-3g.script.so" "$(DESTDIR)/$(libdir)/libntfs-3g.so"; \
+-@GENERATE_LDSCRIPT_TRUE@@INSTALL_LIBRARY_TRUE@	fi
+-@GENERATE_LDSCRIPT_FALSE@@INSTALL_LIBRARY_TRUE@	if [ ! "$(rootlibdir)" -ef "$(libdir)" ]; then \
+-@GENERATE_LDSCRIPT_FALSE@@INSTALL_LIBRARY_TRUE@		$(LN_S) "$(rootlibdir)/libntfs-3g.so" "$(DESTDIR)/$(libdir)/libntfs-3g.so"; \
+-@GENERATE_LDSCRIPT_FALSE@@INSTALL_LIBRARY_TRUE@	fi
+-
+ uninstall-local:
+ @INSTALL_LIBRARY_TRUE@	$(RM) -f "$(DESTDIR)/$(rootlibdir)"/libntfs-3g.so*
+ 
diff --git a/ntfs-3g/ntfs3g-2016.2.22-sysmacros.patch b/ntfs-3g/ntfs3g-2016.2.22-sysmacros.patch
new file mode 100644
index 000000000..2fa1f2b34
--- /dev/null
+++ b/ntfs-3g/ntfs3g-2016.2.22-sysmacros.patch
@@ -0,0 +1,43 @@
+include the headers that define major/minor/makedev in more places
+
+https://bugs.gentoo.org/580136
+
+--- a/libntfs-3g/ioctl.c
++++ b/libntfs-3g/ioctl.c
+@@ -57,6 +57,12 @@
+ #ifdef HAVE_SYS_TYPES_H
+ #include <sys/types.h>
+ #endif
++#ifdef HAVE_SYS_MKDEV_H
++#include <sys/mkdev.h>
++#endif
++#ifdef HAVE_SYS_SYSMACROS_H
++#include <sys/sysmacros.h>
++#endif
+ 
+ #ifdef HAVE_SYS_STAT_H
+ #include <sys/stat.h>
+--- a/src/lowntfs-3g.c
++++ b/src/lowntfs-3g.c
+@@ -76,6 +76,9 @@
+ #ifdef HAVE_SYS_MKDEV_H
+ #include <sys/mkdev.h>
+ #endif
++#ifdef HAVE_SYS_SYSMACROS_H
++#include <sys/sysmacros.h>
++#endif
+ 
+ #if defined(__APPLE__) || defined(__DARWIN__)
+ #include <sys/dirent.h>
+--- a/src/ntfs-3g.c
++++ b/src/ntfs-3g.c
+@@ -75,6 +75,9 @@
+ #ifdef HAVE_SYS_MKDEV_H
+ #include <sys/mkdev.h>
+ #endif
++#ifdef HAVE_SYS_SYSMACROS_H
++#include <sys/sysmacros.h>
++#endif
+ 
+ #if defined(__APPLE__) || defined(__DARWIN__)
+ #include <sys/dirent.h>
diff --git a/ntfs-3g/ntfs3g-2017.3.23-big-sectors.patch b/ntfs-3g/ntfs3g-2017.3.23-big-sectors.patch
new file mode 100644
index 000000000..1cb8bb6c4
--- /dev/null
+++ b/ntfs-3g/ntfs3g-2017.3.23-big-sectors.patch
@@ -0,0 +1,379 @@
+--- a/libntfs-3g/bootsect.c.ref	2017-03-23 10:42:44.000000000 +0100
++++ b/libntfs-3g/bootsect.c	2018-05-07 09:11:13.004710800 +0200
+@@ -38,6 +38,7 @@ 
+ #include <errno.h>
+ #endif
+ 
++#include "param.h"
+ #include "compat.h"
+ #include "bootsect.h"
+ #include "debug.h"
+@@ -61,6 +62,7 @@ 
+ {
+ 	u32 i;
+ 	BOOL ret = FALSE;
++	u16 sectors_per_cluster;
+ 
+ 	ntfs_log_debug("Beginning bootsector check.\n");
+ 
+@@ -83,15 +85,27 @@ 
+ 	case 1: case 2: case 4: case 8: case 16: case 32: case 64: case 128:
+ 		break;
+ 	default:
+-		ntfs_log_error("Unexpected sectors per cluster value (%d).\n",
+-			       b->bpb.sectors_per_cluster);
+-		goto not_ntfs;
++		if ((b->bpb.sectors_per_cluster < 240)
++		    || (b->bpb.sectors_per_cluster > 249)) {
++			if (b->bpb.sectors_per_cluster > 128)
++				ntfs_log_error("Unexpected sectors"
++					" per cluster value (code 0x%x)\n",
++					b->bpb.sectors_per_cluster);
++			else
++				ntfs_log_error("Unexpected sectors"
++					" per cluster value (%d).\n",
++					b->bpb.sectors_per_cluster);
++			goto not_ntfs;
++		}
+ 	}
+ 
+ 	ntfs_log_debug("Checking cluster size.\n");
+-	i = (u32)le16_to_cpu(b->bpb.bytes_per_sector) * 
+-		b->bpb.sectors_per_cluster;
+-	if (i > 65536) {
++	if (b->bpb.sectors_per_cluster > 128)
++		sectors_per_cluster = 1 << (256 - b->bpb.sectors_per_cluster);
++	else
++		sectors_per_cluster = b->bpb.sectors_per_cluster;
++	i = (u32)le16_to_cpu(b->bpb.bytes_per_sector) * sectors_per_cluster;
++	if (i > NTFS_MAX_CLUSTER_SIZE) {
+ 		ntfs_log_error("Unexpected cluster size (%d).\n", i);
+ 		goto not_ntfs;
+ 	}
+@@ -171,7 +185,7 @@ 
+ int ntfs_boot_sector_parse(ntfs_volume *vol, const NTFS_BOOT_SECTOR *bs)
+ {
+ 	s64 sectors;
+-	u8  sectors_per_cluster;
++	u16  sectors_per_cluster;
+ 	s8  c;
+ 
+ 	/* We return -1 with errno = EINVAL on error. */
+@@ -186,7 +200,10 @@ 
+ 	 * below or equal the number_of_clusters) really belong in the
+ 	 * ntfs_boot_sector_is_ntfs but in this way we can just do this once.
+ 	 */
+-	sectors_per_cluster = bs->bpb.sectors_per_cluster;
++	if (bs->bpb.sectors_per_cluster > 128)
++		sectors_per_cluster = 1 << (256 - bs->bpb.sectors_per_cluster);
++	else
++		sectors_per_cluster = bs->bpb.sectors_per_cluster;
+ 	ntfs_log_debug("SectorsPerCluster = 0x%x\n", sectors_per_cluster);
+ 	if (sectors_per_cluster & (sectors_per_cluster - 1)) {
+ 		ntfs_log_error("sectors_per_cluster (%d) is not a power of 2."
+--- a/ntfsprogs/mkntfs.8.in.ref	2017-03-23 10:42:44.000000000 +0100
++++ b/ntfsprogs/mkntfs.8.in	2018-05-07 09:11:13.014132400 +0200
+@@ -132,7 +132,7 @@ 
+ .TP
+ \fB\-c\fR, \fB\-\-cluster\-size\fR BYTES
+ Specify the size of clusters in bytes. Valid cluster size values are powers of
+-two, with at least 256, and at most 65536 bytes per cluster. If omitted,
++two, with at least 256, and at most 2097152 bytes (2MB) per cluster. If omitted,
+ .B mkntfs
+ uses 4096 bytes as the default cluster size.
+ .sp
+--- a/ntfsprogs/mkntfs.c.ref	2017-03-23 10:42:44.000000000 +0100
++++ b/ntfsprogs/mkntfs.c	2018-05-07 09:11:13.035522300 +0200
+@@ -6,7 +6,7 @@ 
+  * Copyright (c) 2002-2006 Szabolcs Szakacsits
+  * Copyright (c) 2005      Erik Sornes
+  * Copyright (c) 2007      Yura Pakhuchiy
+- * Copyright (c) 2010-2014 Jean-Pierre Andre
++ * Copyright (c) 2010-2018 Jean-Pierre Andre
+  *
+  * This utility will create an NTFS 1.2 or 3.1 volume on a user
+  * specified (block) device.
+@@ -119,6 +119,7 @@ 
+ #	endif
+ #endif
+ 
++#include "param.h"
+ #include "security.h"
+ #include "types.h"
+ #include "attrib.h"
+@@ -287,7 +288,7 @@ 
+ 	ntfs_log_info("Copyright (c) 2002-2006 Szabolcs Szakacsits\n");
+ 	ntfs_log_info("Copyright (c) 2005      Erik Sornes\n");
+ 	ntfs_log_info("Copyright (c) 2007      Yura Pakhuchiy\n");
+-	ntfs_log_info("Copyright (c) 2010-2014 Jean-Pierre Andre\n");
++	ntfs_log_info("Copyright (c) 2010-2018 Jean-Pierre Andre\n");
+ 	ntfs_log_info("\n%s\n%s%s\n", ntfs_gpl, ntfs_bugs, ntfs_home);
+ }
+ 
+@@ -3719,11 +3720,11 @@ 
+ 		/*
+ 		 * For huge volumes, grow the cluster size until the number of
+ 		 * clusters fits into 32 bits or the cluster size exceeds the
+-		 * maximum limit of 64kiB.
++		 * maximum limit of NTFS_MAX_CLUSTER_SIZE.
+ 		 */
+ 		while (volume_size >> (ffs(vol->cluster_size) - 1 + 32)) {
+ 			vol->cluster_size <<= 1;
+-			if (vol->cluster_size > 65535) {
++			if (vol->cluster_size >= NTFS_MAX_CLUSTER_SIZE) {
+ 				ntfs_log_error("Device is too large to hold an "
+ 						"NTFS volume (maximum size is "
+ 						"256TiB).\n");
+@@ -3744,15 +3745,18 @@ 
+ 				"to, or larger than, the sector size.\n");
+ 		return FALSE;
+ 	}
+-	if (vol->cluster_size > 128 * (u32)opts.sector_size) {
++		/* Before Windows 10 Creators, the limit was 128 */
++	if (vol->cluster_size > 4096 * (u32)opts.sector_size) {
+ 		ntfs_log_error("The cluster size is invalid.  It cannot be "
+-				"more that 128 times the size of the sector "
++				"more that 4096 times the size of the sector "
+ 				"size.\n");
+ 		return FALSE;
+ 	}
+-	if (vol->cluster_size > 65536) {
++	if (vol->cluster_size > NTFS_MAX_CLUSTER_SIZE) {
+ 		ntfs_log_error("The cluster size is invalid.  The maximum "
+-			"cluster size is 65536 bytes (64kiB).\n");
++			"cluster size is %lu bytes (%lukiB).\n",
++			(unsigned long)NTFS_MAX_CLUSTER_SIZE,
++			(unsigned long)(NTFS_MAX_CLUSTER_SIZE >> 10));
+ 		return FALSE;
+ 	}
+ 	vol->cluster_size_bits = ffs(vol->cluster_size) - 1;
+@@ -4387,6 +4391,7 @@ 
+ 	u8 *sd;
+ 	FILE_ATTR_FLAGS extend_flags;
+ 	VOLUME_FLAGS volume_flags = const_cpu_to_le16(0);
++	int sectors_per_cluster;
+ 	int nr_sysfiles;
+ 	int buf_sds_first_size;
+ 	char *buf_sds;
+@@ -4639,8 +4644,11 @@ 
+ 	 * already inserted, so no need to worry about these things.
+ 	 */
+ 	bs->bpb.bytes_per_sector = cpu_to_le16(opts.sector_size);
+-	bs->bpb.sectors_per_cluster = (u8)(g_vol->cluster_size /
+-			opts.sector_size);
++	sectors_per_cluster = g_vol->cluster_size / opts.sector_size;
++	if (sectors_per_cluster > 128)
++		bs->bpb.sectors_per_cluster = 257 - ffs(sectors_per_cluster);
++	else
++		bs->bpb.sectors_per_cluster = sectors_per_cluster;
+ 	bs->bpb.media_type = 0xf8; /* hard disk */
+ 	bs->bpb.sectors_per_track = cpu_to_le16(opts.sectors_per_track);
+ 	ntfs_log_debug("sectors per track = %ld (0x%lx)\n",
+--- a/ntfsprogs/ntfsclone.c.ref	2017-03-23 10:42:44.000000000 +0100
++++ b/ntfsprogs/ntfsclone.c	2018-05-07 09:11:38.245007100 +0200
+@@ -3,7 +3,7 @@ 
+  *
+  * Copyright (c) 2003-2006 Szabolcs Szakacsits
+  * Copyright (c) 2004-2006 Anton Altaparmakov
+- * Copyright (c) 2010-2016 Jean-Pierre Andre
++ * Copyright (c) 2010-2018 Jean-Pierre Andre
+  * Special image format support copyright (c) 2004 Per Olofsson
+  *
+  * Clone NTFS data and/or metadata to a sparse file, image, device or stdout.
+@@ -71,6 +71,7 @@ 
+  */
+ #define NTFS_DO_NOT_CHECK_ENDIANS
+ 
++#include "param.h"
+ #include "debug.h"
+ #include "types.h"
+ #include "support.h"
+@@ -270,7 +271,6 @@ 
+ 
+ #define LAST_METADATA_INODE	11
+ 
+-#define NTFS_MAX_CLUSTER_SIZE	65536
+ #define NTFS_SECTOR_SIZE	  512
+ 
+ #define rounded_up_division(a, b) (((a) + (b - 1)) / (b))
+@@ -393,7 +393,7 @@ 
+ 		   "Efficiently clone, image, restore or rescue an NTFS Volume.\n\n"
+ 		   "Copyright (c) 2003-2006 Szabolcs Szakacsits\n"
+ 		   "Copyright (c) 2004-2006 Anton Altaparmakov\n"
+-		   "Copyright (c) 2010-2016 Jean-Pierre Andre\n\n");
++		   "Copyright (c) 2010-2018 Jean-Pierre Andre\n\n");
+ 	fprintf(stderr, "%s\n%s%s", ntfs_gpl, ntfs_bugs, ntfs_home);
+ 	exit(0);
+ }
+@@ -756,7 +756,7 @@ 
+ 
+ static void copy_cluster(int rescue, u64 rescue_lcn, u64 lcn)
+ {
+-	char buff[NTFS_MAX_CLUSTER_SIZE]; /* overflow checked at mount time */
++	char *buff;
+ 	/* vol is NULL if opt.restore_image is set */
+ 	s32 csize = le32_to_cpu(image_hdr.cluster_size);
+ 	BOOL backup_bootsector;
+@@ -783,6 +783,10 @@ 
+ 		}
+ 	}
+ 
++	buff = (char*)ntfs_malloc(csize);
++	if (!buff)
++		err_exit("Not enough memory");
++
+ // need reading when not about to write ?
+ 	if (read_all(fd, buff, csize) == -1) {
+ 
+@@ -858,6 +862,7 @@ 
+ 		perr_printf("Write failed");
+ #endif
+ 	}
++	free(buff);
+ }
+ 
+ static s64 lseek_out(int fd, s64 pos, int mode)
+@@ -995,7 +1000,11 @@ 
+ 				 struct progress_bar *progress, u64 *p_counter)
+ {
+ 	s64 i;
+-	char buff[NTFS_MAX_CLUSTER_SIZE];
++	char *buff;
++
++	buff = (char*)ntfs_malloc(csize);
++	if (!buff)
++		err_exit("Not enough memory");
+ 
+ 	memset(buff, 0, csize);
+ 
+@@ -1004,6 +1013,7 @@ 
+ 			perr_exit("write_all");
+ 		progress_update(progress, ++(*p_counter));
+ 	}
++	free(buff);
+ }
+ 
+ static void restore_image(void)
+@@ -1492,7 +1502,7 @@ 
+ 
+ static void copy_wipe_mft(ntfs_walk_clusters_ctx *image, runlist *rl)
+ {
+-	char buff[NTFS_MAX_CLUSTER_SIZE]; /* overflow checked at mount time */
++	char *buff;
+ 	void *fd;
+ 	s64 mft_no;
+ 	u32 mft_record_size;
+@@ -1522,6 +1532,10 @@ 
+ 		clusters_per_set = mft_record_size/csize;
+ 		records_per_set = 1;
+ 	}
++	buff = (char*)ntfs_malloc(mft_record_size);
++	if (!buff)
++		err_exit("Not enough memory");
++
+ 	mft_no = 0;
+ 	ri = rj = 0;
+ 	wi = wj = 0;
+@@ -1554,6 +1568,7 @@ 
+ 		}
+ 	}
+ 	image->current_lcn = current_lcn;
++	free(buff);
+ }
+ 
+ /*
+@@ -1566,7 +1581,7 @@ 
+ 
+ static void copy_wipe_i30(ntfs_walk_clusters_ctx *image, runlist *rl)
+ {
+-	char buff[NTFS_MAX_CLUSTER_SIZE]; /* overflow checked at mount time */
++	char *buff;
+ 	void *fd;
+ 	u32 indx_record_size;
+ 	u32 csize;
+@@ -1595,6 +1610,10 @@ 
+ 		clusters_per_set = indx_record_size/csize;
+ 		records_per_set = 1;
+ 	}
++	buff = (char*)ntfs_malloc(indx_record_size);
++	if (!buff)
++		err_exit("Not enough memory");
++
+ 	ri = rj = 0;
+ 	wi = wj = 0;
+ 	if (rl[ri].length)
+@@ -1627,6 +1646,7 @@ 
+ 		}
+ 	}
+ 	image->current_lcn = current_lcn;
++	free(buff);
+ }
+ 
+ static void dump_clusters(ntfs_walk_clusters_ctx *image, runlist *rl)
+--- a/ntfsprogs/ntfsresize.c.ref	2017-03-23 10:42:44.000000000 +0100
++++ b/ntfsprogs/ntfsresize.c	2018-05-07 09:11:13.076883400 +0200
+@@ -59,6 +59,7 @@ 
+ #include <fcntl.h>
+ #endif
+ 
++#include "param.h"
+ #include "debug.h"
+ #include "types.h"
+ #include "support.h"
+@@ -243,8 +244,6 @@ 
+ #define DIRTY_INODE		(1)
+ #define DIRTY_ATTRIB		(2)
+ 
+-#define NTFS_MAX_CLUSTER_SIZE	(65536)
+-
+ static s64 rounded_up_division(s64 numer, s64 denom)
+ {
+ 	return (numer + (denom - 1)) / denom;
+@@ -404,7 +403,7 @@ 
+ 	printf("Copyright (c) 2002-2005  Anton Altaparmakov\n");
+ 	printf("Copyright (c) 2002-2003  Richard Russon\n");
+ 	printf("Copyright (c) 2007       Yura Pakhuchiy\n");
+-	printf("Copyright (c) 2011-2016  Jean-Pierre Andre\n");
++	printf("Copyright (c) 2011-2018  Jean-Pierre Andre\n");
+ 	printf("\n%s\n%s%s", ntfs_gpl, ntfs_bugs, ntfs_home);
+ }
+ 
+@@ -1849,9 +1848,13 @@ 
+ static void copy_clusters(ntfs_resize_t *resize, s64 dest, s64 src, s64 len)
+ {
+ 	s64 i;
+-	char buff[NTFS_MAX_CLUSTER_SIZE]; /* overflow checked at mount time */
++	char *buff;
+ 	ntfs_volume *vol = resize->vol;
+ 
++	buff = (char*)ntfs_malloc(vol->cluster_size);
++	if (!buff)
++		perr_exit("ntfs_malloc");
++
+ 	for (i = 0; i < len; i++) {
+ 
+ 		lseek_to_cluster(vol, src + i);
+@@ -1875,6 +1878,7 @@ 
+ 		resize->relocations++;
+ 		progress_update(&resize->progress, resize->relocations);
+ 	}
++	free(buff);
+ }
+ 
+ static void relocate_clusters(ntfs_resize_t *r, runlist *dest_rl, s64 src_lcn)
+--- a/include/ntfs-3g/param.h.ref	2017-03-23 10:42:44.000000000 +0100
++++ b/include/ntfs-3g/param.h	2018-05-07 09:11:13.088302600 +0200
+@@ -40,6 +40,13 @@ 
+ };
+ 
+ /*
++ *		Parameters for formatting
++ */
++
++		/* Up to Windows 10, the cluster size was limited to 64K */
++#define NTFS_MAX_CLUSTER_SIZE 2097152 /* Windows 10 Creators allows 2MB */
++
++/*
+  *		Parameters for compression
+  */
+ 
diff --git a/ntfs-3g/ntfs3g-2017.3.23-check-mftmirr.patch b/ntfs-3g/ntfs3g-2017.3.23-check-mftmirr.patch
new file mode 100644
index 000000000..f56eadc88
--- /dev/null
+++ b/ntfs-3g/ntfs3g-2017.3.23-check-mftmirr.patch
@@ -0,0 +1,12 @@
+--- a/libntfs-3g/volume.c.ref	2017-03-23 10:42:44.000000000 +0100
++++ b/libntfs-3g/volume.c	2017-12-20 08:11:51.842424300 +0100
+@@ -959,7 +959,8 @@
+ 		vol->mftmirr_size = l;
+ 	}
+ 	ntfs_log_debug("Comparing $MFTMirr to $MFT...\n");
+-	for (i = 0; i < vol->mftmirr_size; ++i) {
++		/* Windows 10 does not update the full $MFTMirr any more */
++	for (i = 0; (i < vol->mftmirr_size) && (i < FILE_first_user); ++i) {
+ 		MFT_RECORD *mrec, *mrec2;
+ 		const char *ESTR[12] = { "$MFT", "$MFTMirr", "$LogFile",
+ 			"$Volume", "$AttrDef", "root directory", "$Bitmap",
diff --git a/ntfs-3g/ntfs3g-2017.3.23-full-clusters.patch b/ntfs-3g/ntfs3g-2017.3.23-full-clusters.patch
new file mode 100644
index 000000000..7d2496d37
--- /dev/null
+++ b/ntfs-3g/ntfs3g-2017.3.23-full-clusters.patch
@@ -0,0 +1,81 @@
+--- a/ntfsprogs/ntfsclone.c	2018-05-16 18:46:47.114964000 +0200
++++ b/ntfsprogs/ntfsclone.c	2018-07-16 14:03:20.273809100 +0200
+@@ -776,6 +776,10 @@ 
+ 
+ 		/* possible partial cluster holding the backup boot sector */
+ 	backup_bootsector = (lcn + 1)*csize >= full_device_size;
++	buff = (char*)ntfs_malloc(csize);
++	if (!buff)
++		err_exit("Not enough memory");
++
+ 	if (backup_bootsector) {
+ 		csize = full_device_size - lcn*csize;
+ 		if (csize < 0) {
+@@ -783,10 +787,6 @@ 
+ 		}
+ 	}
+ 
+-	buff = (char*)ntfs_malloc(csize);
+-	if (!buff)
+-		err_exit("Not enough memory");
+-
+ // need reading when not about to write ?
+ 	if (read_all(fd, buff, csize) == -1) {
+ 
+@@ -1507,6 +1507,7 @@ 
+ 	s64 mft_no;
+ 	u32 mft_record_size;
+ 	u32 csize;
++	u32 buff_size;
+ 	u32 bytes_per_sector;
+ 	u32 records_per_set;
+ 	u32 clusters_per_set;
+@@ -1524,15 +1525,18 @@ 
+ 		/*
+ 		 * Depending on the sizes, there may be several records
+ 		 * per cluster, or several clusters per record.
++		 * Anyway, full clusters are needed for rescuing bad ones.
+ 		 */
+ 	if (csize >= mft_record_size) {
+ 		records_per_set = csize/mft_record_size;
+ 		clusters_per_set = 1;
++		buff_size = csize;
+ 	} else {
+ 		clusters_per_set = mft_record_size/csize;
+ 		records_per_set = 1;
++		buff_size = mft_record_size;
+ 	}
+-	buff = (char*)ntfs_malloc(mft_record_size);
++	buff = (char*)ntfs_malloc(buff_size);
+ 	if (!buff)
+ 		err_exit("Not enough memory");
+ 
+@@ -1585,6 +1589,7 @@ 
+ 	void *fd;
+ 	u32 indx_record_size;
+ 	u32 csize;
++	u32 buff_size;
+ 	u32 bytes_per_sector;
+ 	u32 records_per_set;
+ 	u32 clusters_per_set;
+@@ -1601,16 +1606,19 @@ 
+ 		/*
+ 		 * Depending on the sizes, there may be several records
+ 		 * per cluster, or several clusters per record.
++		 * Anyway, full clusters are needed for rescuing bad ones.
+ 		 */
+ 	indx_record_size = image->ni->vol->indx_record_size;
+ 	if (csize >= indx_record_size) {
+ 		records_per_set = csize/indx_record_size;
+ 		clusters_per_set = 1;
++		buff_size = csize;
+ 	} else {
+ 		clusters_per_set = indx_record_size/csize;
+ 		records_per_set = 1;
++		buff_size = indx_record_size;
+ 	}
+-	buff = (char*)ntfs_malloc(indx_record_size);
++	buff = (char*)ntfs_malloc(buff_size);
+ 	if (!buff)
+ 		err_exit("Not enough memory");
+