public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Vitezslav Crhonek <vcrhonek@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/tog-pegasus] rawhide: Fix buffer overflows in sample CMPI providers
Date: Fri, 31 Jul 2026 08:09:06 GMT [thread overview]
Message-ID: <178548534659.1.17626527773941576304.rpms-tog-pegasus-44ab874fc3fe@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/tog-pegasus
Branch : rawhide
Commit : 44ab874fc3fe2f45155d477412bc1201b050a75f
Author : Vitezslav Crhonek <vcrhonek@redhat.com>
Date : 2026-07-31T10:08:49+02:00
Stats : +68/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/tog-pegasus/c/44ab874fc3fe2f45155d477412bc1201b050a75f?branch=rawhide
Log:
Fix buffer overflows in sample CMPI providers
---
diff --git a/pegasus-2.14.4-sample-provider-buffer-overflows.patch b/pegasus-2.14.4-sample-provider-buffer-overflows.patch
new file mode 100644
index 0000000..ac17d38
--- /dev/null
+++ b/pegasus-2.14.4-sample-provider-buffer-overflows.patch
@@ -0,0 +1,61 @@
+diff -up pegasus/src/Providers/sample/CMPI/FilesAndDirectories/CWS_FileUtils.c.sample-provider-buffer-overflows pegasus/src/Providers/sample/CMPI/FilesAndDirectories/CWS_FileUtils.c
+--- pegasus/src/Providers/sample/CMPI/FilesAndDirectories/CWS_FileUtils.c.sample-provider-buffer-overflows 2026-07-31 09:07:36.988755691 +0200
++++ pegasus/src/Providers/sample/CMPI/FilesAndDirectories/CWS_FileUtils.c 2026-07-31 09:06:48.636996452 +0200
+@@ -157,7 +157,9 @@ int makeFileBuf(const CMPIInstance *inst
+ // Name needs be valid before copied using strcpy
+ if (CMPI_goodValue == dt.state)
+ {
+- strcpy(cwsf->cws_name,CMGetCharsPtr(dt.value.string,NULL));
++ strncpy(cwsf->cws_name,CMGetCharsPtr(dt.value.string,NULL),
++ sizeof(cwsf->cws_name) - 1);
++ cwsf->cws_name[sizeof(cwsf->cws_name) - 1] = '\0';
+ }
+ }
+ dt=CMGetProperty(instance,"FileSize",&rc);
+diff -up pegasus/src/Providers/sample/CMPI/MethodProvider/cmpiMethodProvider.c.sample-provider-buffer-overflows pegasus/src/Providers/sample/CMPI/MethodProvider/cmpiMethodProvider.c
+--- pegasus/src/Providers/sample/CMPI/MethodProvider/cmpiMethodProvider.c.sample-provider-buffer-overflows 2026-07-31 09:07:37.341753813 +0200
++++ pegasus/src/Providers/sample/CMPI/MethodProvider/cmpiMethodProvider.c 2026-07-31 09:06:50.065989395 +0200
+@@ -97,8 +97,10 @@ CMPIStatus SampleCMPIMethodProviderInvok
+ if(data.type == CMPI_string && !(CMIsNullValue(data)))
+ {
+ strCat = CMGetCharsPtr(data.value.string, &rc);
+- strcat(result, strCat);
+- strcat(result, "!");
++ strncat(result, strCat,
++ sizeof(result) - strlen(result) - 1);
++ strncat(result, "!",
++ sizeof(result) - strlen(result) - 1);
+ /* create the new string to return to client */
+ str1 = CMNewString(_broker, result, &rc);
+ val1.string = str1;
+diff -up pegasus/src/Providers/sample/CMPI/SampleClass/CMPISampleClass.c.sample-provider-buffer-overflows pegasus/src/Providers/sample/CMPI/SampleClass/CMPISampleClass.c
+--- pegasus/src/Providers/sample/CMPI/SampleClass/CMPISampleClass.c.sample-provider-buffer-overflows 2026-07-31 09:07:37.702751892 +0200
++++ pegasus/src/Providers/sample/CMPI/SampleClass/CMPISampleClass.c 2026-07-31 09:06:52.710976329 +0200
+@@ -305,10 +305,9 @@ CMPIStatus testProvInvokeMethod
+ #ifdef PEGASUS_DEBUG
+ fprintf (stderr, "+++ testProvInvokeMethod()\n");
+ #endif
+- strcpy (data, "hallo! dir: ");
+- strcat (data, (char *) (CMGetArg (in, "dir", &rc).value.string->hdl));
+- strcat (data, " type: ");
+- strcat (data, (char *) (CMGetArg (in, "type", &rc).value.string->hdl));
++ snprintf (data, sizeof(data), "hallo! dir: %s type: %s",
++ (char *) (CMGetArg (in, "dir", &rc).value.string->hdl),
++ (char *) (CMGetArg (in, "type", &rc).value.string->hdl));
+
+ CMReturnData (rslt, data, CMPI_chars);
+ CMReturnDone (rslt);
+diff -up pegasus/src/SDK/samples/Providers/CMPI/FilesAndDirectories/CWS_FileUtils.c.sample-provider-buffer-overflows pegasus/src/SDK/samples/Providers/CMPI/FilesAndDirectories/CWS_FileUtils.c
+--- pegasus/src/SDK/samples/Providers/CMPI/FilesAndDirectories/CWS_FileUtils.c.sample-provider-buffer-overflows 2026-07-31 09:07:38.050750041 +0200
++++ pegasus/src/SDK/samples/Providers/CMPI/FilesAndDirectories/CWS_FileUtils.c 2026-07-31 09:06:54.808965965 +0200
+@@ -154,7 +154,9 @@ int makeFileBuf(const CMPIInstance *inst
+ dt=CMGetProperty(instance,"Name",&rc);
+ if (rc.rc == CMPI_RC_OK)
+ {
+- strcpy(cwsf->cws_name,CMGetCharsPtr(dt.value.string,NULL));
++ strncpy(cwsf->cws_name,CMGetCharsPtr(dt.value.string,NULL),
++ sizeof(cwsf->cws_name) - 1);
++ cwsf->cws_name[sizeof(cwsf->cws_name) - 1] = '\0';
+ }
+ dt=CMGetProperty(instance,"FileSize",&rc);
+ if (rc.rc == CMPI_RC_OK)
diff --git a/tog-pegasus.spec b/tog-pegasus.spec
index 0de118a..5f66b0b 100644
--- a/tog-pegasus.spec
+++ b/tog-pegasus.spec
@@ -6,7 +6,7 @@
Name: tog-pegasus
Version: %{major_ver}.4
-Release: 1%{?dist}
+Release: 2%{?dist}
Epoch: 2
Summary: OpenPegasus WBEM Services for Linux
@@ -113,6 +113,8 @@ Patch31: pegasus-2.14.1-ssl-certs-gen-changes.patch
Patch32: pegasus-2.14.1-post-quantum.patch
# fix OpenSSL 4.0 compatibility
Patch33: pegasus-2.14.1-openssl-4.0-fix.patch
+# fix buffer overflows in sample CMPI providers (CWE-120)
+Patch34: pegasus-2.14.4-sample-provider-buffer-overflows.patch
BuildRequires: libstdc++, pam-devel
BuildRequires: openssl, openssl-devel
@@ -275,6 +277,7 @@ yes | pegasus/mak/CreateDmtfSchema 238 %{_builddir}/cim_schema_2.38.0-MOFs.zip c
%patch -P31 -p0 -b .ssl-certs-gen-changes
%patch -P32 -p0 -b .post-quantum
%patch -P33 -p0 -b .openssl-4.0-fix
+%patch -P34 -p0 -b .sample-provider-buffer-overflows
%build
@@ -576,6 +579,9 @@ fi
%changelog
+* Fri Jul 31 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.4-2
+- Fix buffer overflows in sample CMPI providers (CWE-120)
+
* Tue Jul 21 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.4-1
- Update to upstream version 2.14.4
reply other threads:[~2026-07-31 8:09 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178548534659.1.17626527773941576304.rpms-tog-pegasus-44ab874fc3fe@fedoraproject.org \
--to=vcrhonek@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox