[rpms/corosync-epel] epel9: Sync corosync package version with c9s

[rpms/corosync-epel] epel9: Sync corosync package version with c9s

[Jan Friesse]

            A new commit has been pushed.

            Repo   : rpms/corosync-epel
            Branch : epel9
            Commit : f6935c3d946cd4bab457b584a6d18789802252b3
            Author : Jan Friesse <jfriesse@redhat.com>
            Date   : 2026-07-13T09:10:22+02:00
            Stats  : +114/-73 in 6 file(s)
            URL    : https://src.fedoraproject.org/rpms/corosync-epel/c/f6935c3d946cd4bab457b584a6d18789802252b3?branch=epel9

            Log:
            Sync corosync package version with c9s

- Resolves: rhbz#2499228

Signed-off-by: Jan Friesse <jfriesse@redhat.com>

---
diff --git a/.gitignore b/.gitignore
index 728eda4..9f54868 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 /corosync-3.1.7.tar.gz
 /corosync-3.1.8.tar.gz
 /corosync-3.1.9.tar.gz
+/corosync-3.1.10.tar.gz

diff --git a/RHEL-163817-totemsrp-Return-error-if-sanity-check-fails.patch b/RHEL-163817-totemsrp-Return-error-if-sanity-check-fails.patch
new file mode 100644
index 0000000..8fc1d7b
--- /dev/null
+++ b/RHEL-163817-totemsrp-Return-error-if-sanity-check-fails.patch
@@ -0,0 +1,46 @@
+From a16614accfdb3481264d7281843fadf439d9ab1b Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Thu, 2 Apr 2026 09:00:39 +0200
+Subject: [PATCH 1/2] totemsrp: Return error if sanity check fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Previously, the check_memb_commit_token_sanity function correctly
+checked the minimum message length. However, if the message was too
+short, it incorrectly returned a success code (0) instead of the
+expected failure code (-1).
+
+This commit ensures the appropriate error code is returned when the
+message length sanity check fails.
+
+Fixes: CVE-2026-35091
+
+Reported-by: Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) <sebasjosue84@gmail.com>
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+Also-proposed-by: nicholasyang <nicholas.yang@suse.com>
+Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
+---
+ exec/totemsrp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/exec/totemsrp.c b/exec/totemsrp.c
+index a716ae9f..372a96d1 100644
+--- a/exec/totemsrp.c
++++ b/exec/totemsrp.c
+@@ -3811,10 +3811,10 @@ static int check_memb_commit_token_sanity(
+ 		log_printf (instance->totemsrp_log_level_security,
+ 		    "Received memb_commit_token message is too short...  ignoring.");
+ 
+-		return (0);
++		return (-1);
+ 	}
+ 
+-	addr_entries= mct_msg->addr_entries;
++	addr_entries = mct_msg->addr_entries;
+ 	if (endian_conversion_needed) {
+ 		addr_entries = swab32(addr_entries);
+ 	}
+-- 
+2.47.3
+

diff --git a/RHEL-163838-totemsrp-Fix-integer-overflow-in-memb_join_sanity.patch b/RHEL-163838-totemsrp-Fix-integer-overflow-in-memb_join_sanity.patch
new file mode 100644
index 0000000..0d78101
--- /dev/null
+++ b/RHEL-163838-totemsrp-Fix-integer-overflow-in-memb_join_sanity.patch
@@ -0,0 +1,56 @@
+From 4082294f5094a7591e4e00658c5a605f05d644f1 Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Thu, 2 Apr 2026 09:44:06 +0200
+Subject: [PATCH 2/2] totemsrp: Fix integer overflow in memb_join_sanity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This commit addresses an integer overflow (wraparound) vulnerability
+in the check_memb_join_sanity function.
+
+Previously, the 32-bit unsigned network values proc_list_entries and
+failed_list_entries were added together before being promoted to
+size_t. This allowed the addition to wrap around in 32-bit arithmetic
+(e.g., 0x80000000 + 0x80000000 = 0), resulting in a required_len
+calculation that was incorrectly small.
+
+The solution is to cast the list entries to size_t and verify that
+neither exceeds the maximum allowed value before the addition occurs.
+
+Fixes: CVE-2026-35092
+
+Reported-by: Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) <sebasjosue84@gmail.com>
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+Also-proposed-by: nicholasyang <nicholas.yang@suse.com>
+Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
+---
+ exec/totemsrp.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/exec/totemsrp.c b/exec/totemsrp.c
+index 372a96d1..67596911 100644
+--- a/exec/totemsrp.c
++++ b/exec/totemsrp.c
+@@ -3786,7 +3786,17 @@ static int check_memb_join_sanity(
+ 		failed_list_entries = swab32(failed_list_entries);
+ 	}
+ 
+-	required_len = sizeof(struct memb_join) + ((proc_list_entries + failed_list_entries) * sizeof(struct srp_addr));
++	if (proc_list_entries > PROCESSOR_COUNT_MAX ||
++	    failed_list_entries > PROCESSOR_COUNT_MAX) {
++		log_printf (instance->totemsrp_log_level_security,
++		    "Received memb_join message list_entries exceeds the maximum "
++		    "allowed value...  ignoring.");
++
++		return (-1);
++	}
++
++	required_len = sizeof(struct memb_join) +
++	  (((size_t)proc_list_entries + (size_t)failed_list_entries) * sizeof(struct srp_addr));
+ 	if (msg_len < required_len) {
+ 		log_printf (instance->totemsrp_log_level_security,
+ 		    "Received memb_join message is too short...  ignoring.");
+-- 
+2.47.3
+

diff --git a/RHEL-84616-totemsrp-Check-size-of-orf_token-msg.patch b/RHEL-84616-totemsrp-Check-size-of-orf_token-msg.patch
deleted file mode 100644
index 17b4c3e..0000000
--- a/RHEL-84616-totemsrp-Check-size-of-orf_token-msg.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 7839990f9cdf34e55435ed90109e82709032466a Mon Sep 17 00:00:00 2001
-From: Jan Friesse <jfriesse@redhat.com>
-Date: Mon, 24 Mar 2025 12:05:08 +0100
-Subject: [PATCH] totemsrp: Check size of orf_token msg
-
-orf_token message is stored into preallocated array on endian convert
-so carefully crafted malicious message can lead to crash of corosync.
-
-Solution is to check message size beforehand.
-
-Signed-off-by: Jan Friesse <jfriesse@redhat.com>
-Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
----
- exec/totemsrp.c | 18 +++++++++++++++++-
- 1 file changed, 17 insertions(+), 1 deletion(-)
-
-diff --git a/exec/totemsrp.c b/exec/totemsrp.c
-index 962d0e2a..364528ce 100644
---- a/exec/totemsrp.c
-+++ b/exec/totemsrp.c
-@@ -3679,12 +3679,20 @@ static int check_orf_token_sanity(
- 	const struct totemsrp_instance *instance,
- 	const void *msg,
- 	size_t msg_len,
-+	size_t max_msg_len,
- 	int endian_conversion_needed)
- {
- 	int rtr_entries;
- 	const struct orf_token *token = (const struct orf_token *)msg;
- 	size_t required_len;
- 
-+	if (msg_len > max_msg_len) {
-+		log_printf (instance->totemsrp_log_level_security,
-+		    "Received orf_token message is too long...  ignoring.");
-+
-+		return (-1);
-+	}
-+
- 	if (msg_len < sizeof(struct orf_token)) {
- 		log_printf (instance->totemsrp_log_level_security,
- 		    "Received orf_token message is too short...  ignoring.");
-@@ -3698,6 +3706,13 @@ static int check_orf_token_sanity(
- 		rtr_entries = token->rtr_list_entries;
- 	}
- 
-+	if (rtr_entries > RETRANSMIT_ENTRIES_MAX) {
-+		log_printf (instance->totemsrp_log_level_security,
-+		    "Received orf_token message rtr_entries is corrupted...  ignoring.");
-+
-+		return (-1);
-+	}
-+
- 	required_len = sizeof(struct orf_token) + rtr_entries * sizeof(struct rtr_item);
- 	if (msg_len < required_len) {
- 		log_printf (instance->totemsrp_log_level_security,
-@@ -3868,7 +3883,8 @@ static int message_handler_orf_token (
- 	    "Time since last token %0.4f ms", tv_diff / (float)QB_TIME_NS_IN_MSEC);
- #endif
- 
--	if (check_orf_token_sanity(instance, msg, msg_len, endian_conversion_needed) == -1) {
-+	if (check_orf_token_sanity(instance, msg, msg_len, sizeof(token_storage),
-+	    endian_conversion_needed) == -1) {
- 		return (0);
- 	}
- 
--- 
-2.47.0
-

diff --git a/corosync-epel.spec b/corosync-epel.spec
index a083152..a186ee1 100644
--- a/corosync-epel.spec
+++ b/corosync-epel.spec
@@ -22,13 +22,14 @@
 
 Name: %{rhel_name}-epel
 Summary: The Corosync Cluster Engine and Application Programming Interfaces
-Version: 3.1.9
+Version: 3.1.10
 Release: 0.%{rhel_release}%{?dist}.%{epel_release}
-License: BSD
+License: BSD-3-Clause
 URL: http://corosync.github.io/corosync/
-Source0: http://build.clusterlabs.org/corosync/releases/%{rhel_name}-%{version}.tar.gz
+Source0: https://github.com/%{rhel_name}/%{rhel_name}/releases/download/v%{version}/%{rhel_name}-%{version}%{?gittarver}.tar.gz
 
-Patch0: RHEL-84616-totemsrp-Check-size-of-orf_token-msg.patch
+Patch0: RHEL-163817-totemsrp-Return-error-if-sanity-check-fails.patch
+Patch1: RHEL-163838-totemsrp-Fix-integer-overflow-in-memb_join_sanity.patch
 
 # Build bits
 BuildRequires: gcc
@@ -229,8 +230,10 @@ fi
 %{_initrddir}/corosync
 %{_initrddir}/corosync-notifyd
 %endif
+%if %{without systemd}
 %dir %{_localstatedir}/lib/corosync
 %dir %{_localstatedir}/log/cluster
+%endif
 %{_mandir}/man7/corosync_overview.7*
 %{_mandir}/man8/corosync.8*
 %{_mandir}/man8/corosync-blackbox.8*
@@ -325,6 +328,9 @@ network splits)
 %endif
 
 %changelog
+* Mon Jul 13 2026 Jan Friesse <jfriesse@redhat.com> - 3.1.10-0.2.1
+- Sync corosync package version with c9s
+
 * Thu May 22 2025 Jan Friesse <jfriesse@redhat.com> - 3.1.9-0.2.1
 - Sync corosync package version with c9s
 

diff --git a/sources b/sources
index d3e0db1..9c626fd 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (corosync-3.1.9.tar.gz) = d5332c65535dd40e3bee48912ebf2e71c55380b3dba93c36ff8b74090edf3ec44b69685cd11fda3732e4b0dab0b2954f08be94d772fcff6aaf9a4a846ef2e4cc
+SHA512 (corosync-3.1.10.tar.gz) = cf2014d15fdbd3495cfe64629255f7855a79651a595938dac7bc7ec67338d843079ae40cf1c15de23b50d85cb39b2c2e3e3448a9cc33759ad8988b8c85ce59d3