In ntfs_name_decode of ntfs.c, the name_length field is read directly from the on-disk $FILE_NAME attribute of an NTFS directory index entry (a value up to 255, fully controlled by whoever crafts the mounted volume or disk image) and used to copy that many characters into a fixed 128-byte destination buffer with no bounds check. This allows a crafted NTFS volume to overflow a stack-allocated array of directory entries simply by listing the directory (e.g. via the ls shell command), corrupting adjacent stack memory.
CWE-121, CWE-20
Artfical DT Developer Talha Berk Arslan