[rpms/sblim-sfcb] rawhide: Fix multiple issues discovered by static analysis

[rpms/sblim-sfcb] rawhide: Fix multiple issues discovered by static analysis

[Vitezslav Crhonek]

A new commit has been pushed.

Repo   : rpms/sblim-sfcb
Branch : rawhide
Commit : a9d4d30810230c458b0c8c383572088937f19b79
Author : Vitezslav Crhonek <vcrhonek@redhat.com>
Date   : 2026-07-22T10:51:18+02:00
Stats  : +542/-1 in 7 file(s)
URL    : https://src.fedoraproject.org/rpms/sblim-sfcb/c/a9d4d30810230c458b0c8c383572088937f19b79?branch=rawhide

Log:
Fix multiple issues discovered by static analysis

---
diff --git a/sblim-sfcb-1.4.9-fix-double-free.patch b/sblim-sfcb-1.4.9-fix-double-free.patch
new file mode 100644
index 0000000..113302f
--- /dev/null
+++ b/sblim-sfcb-1.4.9-fix-double-free.patch
@@ -0,0 +1,20 @@
+diff --git a/constClass.c b/constClass.c
+index 6d53e20..03462be 100644
+--- a/constClass.c
++++ b/constClass.c
+@@ -437,6 +437,7 @@ getPropQualifier(CMPIConstClass * cc, const char *cp, const char *cpq,
+   }
+ 
+   for (i = 0; i < num; i++) {
++    n = NULL;  /* Reset to prevent double-free if next iteration fails */
+     if (ClClassGetPropQualifierAt(cls, p - 1, i, &rv, &n) == 0
+         && strcasecmp(cpq, n) == 0) {
+       if (rv.type == CMPI_chars) {
+@@ -457,6 +458,7 @@ getPropQualifier(CMPIConstClass * cc, const char *cp, const char *cpq,
+     }
+     if (n && isMallocedStrBuf(&cls->hdr)) {
+       free(n);
++      n = NULL;  /* Reset after free */
+     }
+   }
+   if (rc) {

diff --git a/sblim-sfcb-1.4.9-fix-ftell-overflow.patch b/sblim-sfcb-1.4.9-fix-ftell-overflow.patch
new file mode 100644
index 0000000..bfc1c6d
--- /dev/null
+++ b/sblim-sfcb-1.4.9-fix-ftell-overflow.patch
@@ -0,0 +1,29 @@
+diff --git a/fileRepository.c b/fileRepository.c
+index 33a1ce2..7f2914d 100644
+--- a/fileRepository.c
++++ b/fileRepository.c
+@@ -519,8 +519,24 @@ getIndex(const char *ns, const char *cls, int elen, int mki,
+   else {
+     fseek(bi->fx, 0, SEEK_END);
+     bi->dSize = ftell(bi->fx);
++
++    /* Check for ftell() error (returns -1 on failure) */
++    if (bi->dSize < 0) {
++      mlogf(M_ERROR, M_SHOW,
++            "--- ftell() failed on index file %s: %s\n",
++            bi->fnx, strerror(errno));
++      freeBlobIndex(&bi, 1);
++      *bip = NULL;
++      return 0;
++    }
++
+     bi->aSize = bi->dSize + elen;
+     bi->index = malloc(bi->aSize);
++    if (!bi->index) {
++      freeBlobIndex(&bi, 1);
++      *bip = NULL;
++      return 0;
++    }
+     fseek(bi->fx, 0, SEEK_SET);
+     fread(bi->index, bi->dSize, 1, bi->fx);
+     bi->index[bi->dSize] = 0;

diff --git a/sblim-sfcb-1.4.9-fix-incorrect-free.patch b/sblim-sfcb-1.4.9-fix-incorrect-free.patch
new file mode 100644
index 0000000..7a18859
--- /dev/null
+++ b/sblim-sfcb-1.4.9-fix-incorrect-free.patch
@@ -0,0 +1,16 @@
+diff --git a/classProviderMem.c b/classProviderMem.c
+index d6dc465..ff6b081 100644
+--- a/classProviderMem.c
++++ b/classProviderMem.c
+@@ -280,9 +280,8 @@ cpyClass(ClClass * cl, CMPIConstClass * cc)
+   for (i = 0, m = ClClassGetPropertyCount(ccl); i < m; i++) {
+     ClClassGetPropertyAt(ccl, i, &d, &name, &quals, &refName);
+     propId = ClClassAddProperty(cl, name, d, refName);
+-    if (refName) {
+-      free(refName);
+-    }
++    /* Note: refName points into ccl's string buffer, not separately allocated.
++     * ClClassAddProperty copies the string, so no free needed. */
+     prop =
+         ((ClProperty *) ClObjectGetClSection(&cl->hdr, &cl->properties)) +
+         propId - 1;

diff --git a/sblim-sfcb-1.4.9-fix-mof-buffer-overflow.patch b/sblim-sfcb-1.4.9-fix-mof-buffer-overflow.patch
new file mode 100644
index 0000000..a83d157
--- /dev/null
+++ b/sblim-sfcb-1.4.9-fix-mof-buffer-overflow.patch
@@ -0,0 +1,31 @@
+diff --git a/mofpp.c b/mofpp.c
+index 98b7396..f91def9 100644
+--- a/mofpp.c
++++ b/mofpp.c
+@@ -62,11 +62,23 @@ incOK(char *str, char **s, char **e, char **ifn, FILE ** f)
+             **e = 0;
+             if (str[0] != '\\' && str[0] != '/') {
+               /* str is relative path */
+-              strcpy(fn,path);
+-              strcat(fn,str);
++              size_t path_len = strlen(path);
++              size_t str_len = strlen(str);
++              /* Validate combined path fits in buffer */
++              if (path_len + str_len >= sizeof(fn)) {
++                fprintf(stderr, "mofpp: path too long: %s%s\n", path, str);
++                **e = ch;
++                return -1;
++              }
++              snprintf(fn, sizeof(fn), "%s%s", path, str);
+             } else {
+               /* str is absolute path */
+-              strcpy(fn, str);
++              if (strlen(str) >= sizeof(fn)) {
++                fprintf(stderr, "mofpp: path too long: %s\n", str);
++                **e = ch;
++                return -1;
++              }
++              snprintf(fn, sizeof(fn), "%s", str);
+             }
+ 
+             *ifn = strdup(fn);

diff --git a/sblim-sfcb-1.4.9-fix-query-buffer-overflow.patch b/sblim-sfcb-1.4.9-fix-query-buffer-overflow.patch
new file mode 100644
index 0000000..342e77d
--- /dev/null
+++ b/sblim-sfcb-1.4.9-fix-query-buffer-overflow.patch
@@ -0,0 +1,346 @@
+diff --git a/queryOperation.c b/queryOperation.c
+index b38f5a2..13a30b7 100644
+--- a/queryOperation.c
++++ b/queryOperation.c
+@@ -1115,11 +1115,32 @@ _ltEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ ltToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, (op->flag.invert ? " QL_GE " : " QL_LT "));
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = (op->flag.invert ? " QL_GE " : " QL_LT ");
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp
+@@ -1155,11 +1176,32 @@ _gtEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ gtToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, (op->flag.invert ? " QL_LE " : " QL_GT "));
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = (op->flag.invert ? " QL_LE " : " QL_GT ");
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp
+@@ -1195,11 +1237,32 @@ _leEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ leToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, (op->flag.invert ? " QL_GT " : " QL_LE "));
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = (op->flag.invert ? " QL_GT " : " QL_LE ");
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp
+@@ -1235,11 +1298,32 @@ _geEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ geToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, (op->flag.invert ? " QL_LT " : " QL_GE "));
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = (op->flag.invert ? " QL_LT " : " QL_GE ");
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp
+@@ -1275,11 +1359,32 @@ _eqEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ eqToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, (op->flag.invert ? " QL_NE " : " QL_EQ "));
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = (op->flag.invert ? " QL_NE " : " QL_EQ ");
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp
+@@ -1315,11 +1420,32 @@ _neEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ neToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, (op->flag.invert ? " QL_EQ " : " QL_NE "));
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = (op->flag.invert ? " QL_EQ " : " QL_NE ");
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp
+@@ -1355,11 +1481,32 @@ _isaEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ isaToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, (op->flag.invert ? " QL_NOT_ISA " : " QL_ISA "));
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = (op->flag.invert ? " QL_NOT_ISA " : " QL_ISA ");
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp
+@@ -1455,11 +1602,32 @@ _likeEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ likeToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, "QL_LIKE ");
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = "QL_LIKE ";
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp
+@@ -1504,11 +1672,32 @@ _notLikeEvaluate(QLOperation * op, QLPropertySource * source)
+ char           *
+ notLikeToString(QLOperation * op)
+ {
+-  char            str[512];
+-  strcpy(str, op->lhod->ft->toString(op->lhod));
+-  strcat(str, "QL_NOT_LIKE ");
+-  strcat(str, (op->rhod ? op->rhod->ft->toString(op->rhod) : "--"));
+-  return strdup(str);
++  char *ln = NULL;
++  char *rn = NULL;
++  char *result = NULL;
++  const char *op_str = "QL_NOT_LIKE ";
++  const char *rn_safe;
++  size_t len;
++
++  ln = op->lhod->ft->toString(op->lhod);
++  if (!ln)
++    return strdup("--");
++
++  if (op->rhod) {
++    rn = op->rhod->ft->toString(op->rhod);
++    rn_safe = rn ? rn : "--";
++  } else {
++    rn_safe = "--";
++  }
++
++  len = strlen(ln) + strlen(op_str) + strlen(rn_safe) + 1;
++  result = malloc(len);
++  if (result)
++    snprintf(result, len, "%s%s%s", ln, op_str, rn_safe);
++
++  free(ln);
++  free(rn);
++  return result ? result : strdup("--");
+ }
+ 
+ QLOp

diff --git a/sblim-sfcb-1.4.9-fix-tainted-size-allocation.patch b/sblim-sfcb-1.4.9-fix-tainted-size-allocation.patch
new file mode 100644
index 0000000..236d6c2
--- /dev/null
+++ b/sblim-sfcb-1.4.9-fix-tainted-size-allocation.patch
@@ -0,0 +1,78 @@
+diff --git a/classProvider.c b/classProvider.c
+index 9a8765b..16124a5 100644
+--- a/classProvider.c
++++ b/classProvider.c
+@@ -348,9 +348,8 @@ cpyClass(ClClass * cl, const CMPIConstClass * cc)
+     ClClassGetPropertyAt(ccl, i, &d, &name, &quals, &refName);
+ 
+     propId = ClClassAddProperty(cl, name, d, refName);
+-    if (refName) {
+-      free(refName);
+-    }
++    /* Note: refName points into ccl's string buffer, not separately allocated.
++     * ClClassAddProperty copies the string, so no free needed. */
+     prop =
+         ((ClProperty *) ClObjectGetClSection(&cl->hdr, &cl->properties)) +
+         propId - 1;
+@@ -601,7 +600,36 @@ removeClass(ClassRegister * cr, const char *clsName)
+     char           *buf = NULL;
+     char           *cn;
+ 
++    /* Validate hdr.size to prevent heap overflow from tainted file data */
++    if (hdr.size < sizeof(ClObjectHdr)) {
++      mlogf(M_ERROR, M_SHOW,
++            "--- %s contains record with invalid size %u - directory skipped %d\n",
++            cr->fn, hdr.size, __LINE__);
++      fclose(repold);
++      fclose(repnew);
++      unlink(tmpfn);
++      return;
++    }
++    if (hdr.size > 100 * 1024 * 1024) {  /* 100MB sanity limit */
++      mlogf(M_ERROR, M_SHOW,
++            "--- %s contains record with excessive size %u - directory skipped %d\n",
++            cr->fn, hdr.size, __LINE__);
++      fclose(repold);
++      fclose(repnew);
++      unlink(tmpfn);
++      return;
++    }
++
+     buf = malloc(hdr.size);
++    if (!buf) {
++      mlogf(M_ERROR, M_SHOW,
++            "--- malloc(%u) failed for %s - directory skipped %d\n",
++            hdr.size, cr->fn, __LINE__);
++      fclose(repold);
++      fclose(repnew);
++      unlink(tmpfn);
++      return;
++    }
+     *((ClObjectHdr *) buf) = hdr;
+ 
+     if (fread(buf + sizeof(hdr), 1, hdr.size - sizeof(hdr), repold) ==
+diff --git a/classProviderSf.c b/classProviderSf.c
+index 9b0de41..8e50e86 100644
+--- a/classProviderSf.c
++++ b/classProviderSf.c
+@@ -367,6 +367,20 @@ newClassRegister(char *fname)
+       return NULL;
+     }
+ 
++    /* Validate hdr.size to prevent heap overflow from tainted file data */
++    if (hdr.size < sizeof(ClObjectHdr)) {
++      mlogf(M_ERROR, M_SHOW,
++            "--- %s contains record with invalid size %u - directory skipped %d\n",
++            fin, hdr.size, __LINE__);
++      return NULL;
++    }
++    if (hdr.size > 100 * 1024 * 1024) {  /* 100MB sanity limit */
++      mlogf(M_ERROR, M_SHOW,
++            "--- %s contains record with excessive size %u - directory skipped %d\n",
++            fin, hdr.size, __LINE__);
++      return NULL;
++    }
++
+     buf = malloc(hdr.size);
+     if (buf == NULL) {
+       mlogf(M_ERROR, M_SHOW,

diff --git a/sblim-sfcb.spec b/sblim-sfcb.spec
index 62fa538..06be50e 100644
--- a/sblim-sfcb.spec
+++ b/sblim-sfcb.spec
@@ -8,7 +8,7 @@ Name: sblim-sfcb
 Summary: Small Footprint CIM Broker
 URL: http://sblim.wiki.sourceforge.net/
 Version: 1.4.9
-Release: 42%{?dist}
+Release: 43%{?dist}
 License: EPL-1.0
 Source0: http://downloads.sourceforge.net/sblim/%{name}-%{version}.tar.bz2
 Source1: sfcb.service
@@ -46,6 +46,18 @@ Patch10: sblim-sfcb-1.4.9-docdir-license.patch
 # Patch11: adds configuration options to specify fallback SSL cert/key pair
 #   and disables default ECDH ephemeral key generation
 Patch11: sblim-sfcb-1.4.9-post-quantum.patch
+# Patch12: fix stack buffer overflows in query operation toString functions
+Patch12: sblim-sfcb-1.4.9-fix-query-buffer-overflow.patch
+# Patch13: fix stack buffer overflow in MOF preprocessor include handling
+Patch13: sblim-sfcb-1.4.9-fix-mof-buffer-overflow.patch
+# Patch14: fix heap overflow from tainted size in class repository loading
+Patch14: sblim-sfcb-1.4.9-fix-tainted-size-allocation.patch
+# Patch15: fix integer overflow from unchecked ftell return value
+Patch15: sblim-sfcb-1.4.9-fix-ftell-overflow.patch
+# Patch16: fix double-free in property qualifier iteration
+Patch16: sblim-sfcb-1.4.9-fix-double-free.patch
+# Patch17: fix incorrect free of non-allocated pointer
+Patch17: sblim-sfcb-1.4.9-fix-incorrect-free.patch
 Provides: cim-server = 0
 Requires: cim-schema
 Requires: sblim-sfcCommon
@@ -87,6 +99,12 @@ Programming Interface (CMPI).
 %patch -P9 -p1 -b .fix-ppc-optimization-level
 %patch -P10 -p1 -b .docdir-license
 %patch -P11 -p1 -b .post-quantum
+%patch -P12 -p1 -b .fix-query-buffer-overflow
+%patch -P13 -p1 -b .fix-mof-buffer-overflow
+%patch -P14 -p1 -b .fix-tainted-size-allocation
+%patch -P15 -p1 -b .fix-ftell-overflow
+%patch -P16 -p1 -b .fix-double-free
+%patch -P17 -p1 -b .fix-incorrect-free
 
 # Create a sysusers.d config file
 cat >sblim-sfcb.sysusers.conf <<EOF
@@ -155,6 +173,9 @@ fi
 %{_tmpfilesdir}/sblim-sfcb.conf
 
 %changelog
+* Wed Jul 22 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-43
+- Fix multiple issues discovered by static analysis
+
 * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-42
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild