From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Vitezslav Crhonek To: git-commits@fedoraproject.org Subject: [rpms/tog-pegasus] rawhide: Fix buffer overflows in sample CMPI providers Date: Fri, 31 Jul 2026 08:09:06 GMT Message-ID: <178548534659.1.17626527773941576304.rpms-tog-pegasus-44ab874fc3fe@fedoraproject.org> List-ID: X-Git-Repo: rpms/tog-pegasus X-Git-Branch: rawhide X-Git-Rev: 44ab874fc3fe2f45155d477412bc1201b050a75f QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvdG9nLXBlZ2FzdXMK QnJhbmNoIDogcmF3aGlkZQpDb21taXQgOiA0NGFiODc0ZmMzZmUyZjQ1MTU1ZDQ3NzQxMmJjMTIw MWIwNTBhNzVmCkF1dGhvciA6IFZpdGV6c2xhdiBDcmhvbmVrIDx2Y3Job25la0ByZWRoYXQuY29t PgpEYXRlICAgOiAyMDI2LTA3LTMxVDEwOjA4OjQ5KzAyOjAwClN0YXRzICA6ICs2OC8tMSBpbiAy IGZpbGUocykKVVJMICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy90b2ct cGVnYXN1cy9jLzQ0YWI4NzRmYzNmZTJmNDUxNTVkNDc3NDEyYmMxMjAxYjA1MGE3NWY/YnJhbmNo PXJhd2hpZGUKCkxvZzoKRml4IGJ1ZmZlciBvdmVyZmxvd3MgaW4gc2FtcGxlIENNUEkgcHJvdmlk ZXJzCgotLS0KZGlmZiAtLWdpdCBhL3BlZ2FzdXMtMi4xNC40LXNhbXBsZS1wcm92aWRlci1idWZm ZXItb3ZlcmZsb3dzLnBhdGNoIGIvcGVnYXN1cy0yLjE0LjQtc2FtcGxlLXByb3ZpZGVyLWJ1ZmZl ci1vdmVyZmxvd3MucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uYWMx N2QzOAotLS0gL2Rldi9udWxsCisrKyBiL3BlZ2FzdXMtMi4xNC40LXNhbXBsZS1wcm92aWRlci1i dWZmZXItb3ZlcmZsb3dzLnBhdGNoCkBAIC0wLDAgKzEsNjEgQEAKK2RpZmYgLXVwIHBlZ2FzdXMv c3JjL1Byb3ZpZGVycy9zYW1wbGUvQ01QSS9GaWxlc0FuZERpcmVjdG9yaWVzL0NXU19GaWxlVXRp bHMuYy5zYW1wbGUtcHJvdmlkZXItYnVmZmVyLW92ZXJmbG93cyBwZWdhc3VzL3NyYy9Qcm92aWRl cnMvc2FtcGxlL0NNUEkvRmlsZXNBbmREaXJlY3Rvcmllcy9DV1NfRmlsZVV0aWxzLmMKKy0tLSBw ZWdhc3VzL3NyYy9Qcm92aWRlcnMvc2FtcGxlL0NNUEkvRmlsZXNBbmREaXJlY3Rvcmllcy9DV1Nf RmlsZVV0aWxzLmMuc2FtcGxlLXByb3ZpZGVyLWJ1ZmZlci1vdmVyZmxvd3MJMjAyNi0wNy0zMSAw OTowNzozNi45ODg3NTU2OTEgKzAyMDAKKysrKyBwZWdhc3VzL3NyYy9Qcm92aWRlcnMvc2FtcGxl L0NNUEkvRmlsZXNBbmREaXJlY3Rvcmllcy9DV1NfRmlsZVV0aWxzLmMJMjAyNi0wNy0zMSAwOTow Njo0OC42MzY5OTY0NTIgKzAyMDAKK0BAIC0xNTcsNyArMTU3LDkgQEAgaW50IG1ha2VGaWxlQnVm KGNvbnN0IENNUElJbnN0YW5jZSAqaW5zdAorICAgICAgICAgLy8gTmFtZSBuZWVkcyBiZSB2YWxp ZCBiZWZvcmUgY29waWVkIHVzaW5nIHN0cmNweQorICAgICAgICAgaWYgKENNUElfZ29vZFZhbHVl ID09IGR0LnN0YXRlKQorICAgICAgICAgeworLSAgICAgICAgICAgIHN0cmNweShjd3NmLT5jd3Nf bmFtZSxDTUdldENoYXJzUHRyKGR0LnZhbHVlLnN0cmluZyxOVUxMKSk7CisrICAgICAgICAgICAg c3RybmNweShjd3NmLT5jd3NfbmFtZSxDTUdldENoYXJzUHRyKGR0LnZhbHVlLnN0cmluZyxOVUxM KSwKKysgICAgICAgICAgICAgICAgc2l6ZW9mKGN3c2YtPmN3c19uYW1lKSAtIDEpOworKyAgICAg ICAgICAgIGN3c2YtPmN3c19uYW1lW3NpemVvZihjd3NmLT5jd3NfbmFtZSkgLSAxXSA9ICdcMCc7 CisgICAgICAgICB9CisgICAgIH0KKyAgICAgZHQ9Q01HZXRQcm9wZXJ0eShpbnN0YW5jZSwiRmls ZVNpemUiLCZyYyk7CitkaWZmIC11cCBwZWdhc3VzL3NyYy9Qcm92aWRlcnMvc2FtcGxlL0NNUEkv TWV0aG9kUHJvdmlkZXIvY21waU1ldGhvZFByb3ZpZGVyLmMuc2FtcGxlLXByb3ZpZGVyLWJ1ZmZl ci1vdmVyZmxvd3MgcGVnYXN1cy9zcmMvUHJvdmlkZXJzL3NhbXBsZS9DTVBJL01ldGhvZFByb3Zp ZGVyL2NtcGlNZXRob2RQcm92aWRlci5jCistLS0gcGVnYXN1cy9zcmMvUHJvdmlkZXJzL3NhbXBs ZS9DTVBJL01ldGhvZFByb3ZpZGVyL2NtcGlNZXRob2RQcm92aWRlci5jLnNhbXBsZS1wcm92aWRl ci1idWZmZXItb3ZlcmZsb3dzCTIwMjYtMDctMzEgMDk6MDc6MzcuMzQxNzUzODEzICswMjAwCisr KysgcGVnYXN1cy9zcmMvUHJvdmlkZXJzL3NhbXBsZS9DTVBJL01ldGhvZFByb3ZpZGVyL2NtcGlN ZXRob2RQcm92aWRlci5jCTIwMjYtMDctMzEgMDk6MDY6NTAuMDY1OTg5Mzk1ICswMjAwCitAQCAt OTcsOCArOTcsMTAgQEAgQ01QSVN0YXR1cyBTYW1wbGVDTVBJTWV0aG9kUHJvdmlkZXJJbnZvawor ICAgICAgICAgICAgICAgICBpZihkYXRhLnR5cGUgPT0gQ01QSV9zdHJpbmcgJiYgICEoQ01Jc051 bGxWYWx1ZShkYXRhKSkpCisgICAgICAgICAgICAgICAgIHsKKyAgICAgICAgICAgICAgICAgICAg IHN0ckNhdCA9IENNR2V0Q2hhcnNQdHIoZGF0YS52YWx1ZS5zdHJpbmcsICZyYyk7CistICAgICAg ICAgICAgICAgICAgICBzdHJjYXQocmVzdWx0LCBzdHJDYXQpOworLSAgICAgICAgICAgICAgICAg ICAgc3RyY2F0KHJlc3VsdCwgIiEiKTsKKysgICAgICAgICAgICAgICAgICAgIHN0cm5jYXQocmVz dWx0LCBzdHJDYXQsCisrICAgICAgICAgICAgICAgICAgICAgICAgc2l6ZW9mKHJlc3VsdCkgLSBz dHJsZW4ocmVzdWx0KSAtIDEpOworKyAgICAgICAgICAgICAgICAgICAgc3RybmNhdChyZXN1bHQs ICIhIiwKKysgICAgICAgICAgICAgICAgICAgICAgICBzaXplb2YocmVzdWx0KSAtIHN0cmxlbihy ZXN1bHQpIC0gMSk7CisgICAgICAgICAgICAgICAgICAgICAvKiBjcmVhdGUgdGhlIG5ldyBzdHJp bmcgdG8gcmV0dXJuIHRvIGNsaWVudCAqLworICAgICAgICAgICAgICAgICAgICAgc3RyMSA9IENN TmV3U3RyaW5nKF9icm9rZXIsIHJlc3VsdCwgJnJjKTsKKyAgICAgICAgICAgICAgICAgICAgIHZh bDEuc3RyaW5nID0gc3RyMTsKK2RpZmYgLXVwIHBlZ2FzdXMvc3JjL1Byb3ZpZGVycy9zYW1wbGUv Q01QSS9TYW1wbGVDbGFzcy9DTVBJU2FtcGxlQ2xhc3MuYy5zYW1wbGUtcHJvdmlkZXItYnVmZmVy LW92ZXJmbG93cyBwZWdhc3VzL3NyYy9Qcm92aWRlcnMvc2FtcGxlL0NNUEkvU2FtcGxlQ2xhc3Mv Q01QSVNhbXBsZUNsYXNzLmMKKy0tLSBwZWdhc3VzL3NyYy9Qcm92aWRlcnMvc2FtcGxlL0NNUEkv U2FtcGxlQ2xhc3MvQ01QSVNhbXBsZUNsYXNzLmMuc2FtcGxlLXByb3ZpZGVyLWJ1ZmZlci1vdmVy Zmxvd3MJMjAyNi0wNy0zMSAwOTowNzozNy43MDI3NTE4OTIgKzAyMDAKKysrKyBwZWdhc3VzL3Ny Yy9Qcm92aWRlcnMvc2FtcGxlL0NNUEkvU2FtcGxlQ2xhc3MvQ01QSVNhbXBsZUNsYXNzLmMJMjAy Ni0wNy0zMSAwOTowNjo1Mi43MTA5NzYzMjkgKzAyMDAKK0BAIC0zMDUsMTAgKzMwNSw5IEBAIENN UElTdGF0dXMgdGVzdFByb3ZJbnZva2VNZXRob2QKKyAjaWZkZWYgUEVHQVNVU19ERUJVRworICAg ZnByaW50ZiAoc3RkZXJyLCAiKysrIHRlc3RQcm92SW52b2tlTWV0aG9kKClcbiIpOworICNlbmRp ZgorLSAgc3RyY3B5IChkYXRhLCAiaGFsbG8hIGRpcjogIik7CistICBzdHJjYXQgKGRhdGEsIChj aGFyICopIChDTUdldEFyZyAoaW4sICJkaXIiLCAmcmMpLnZhbHVlLnN0cmluZy0+aGRsKSk7Cist ICBzdHJjYXQgKGRhdGEsICIgdHlwZTogIik7CistICBzdHJjYXQgKGRhdGEsIChjaGFyICopIChD TUdldEFyZyAoaW4sICJ0eXBlIiwgJnJjKS52YWx1ZS5zdHJpbmctPmhkbCkpOworKyAgc25wcmlu dGYgKGRhdGEsIHNpemVvZihkYXRhKSwgImhhbGxvISBkaXI6ICVzIHR5cGU6ICVzIiwKKysgICAg KGNoYXIgKikgKENNR2V0QXJnIChpbiwgImRpciIsICZyYykudmFsdWUuc3RyaW5nLT5oZGwpLAor KyAgICAoY2hhciAqKSAoQ01HZXRBcmcgKGluLCAidHlwZSIsICZyYykudmFsdWUuc3RyaW5nLT5o ZGwpKTsKKyAKKyAgIENNUmV0dXJuRGF0YSAocnNsdCwgZGF0YSwgQ01QSV9jaGFycyk7CisgICBD TVJldHVybkRvbmUgKHJzbHQpOworZGlmZiAtdXAgcGVnYXN1cy9zcmMvU0RLL3NhbXBsZXMvUHJv dmlkZXJzL0NNUEkvRmlsZXNBbmREaXJlY3Rvcmllcy9DV1NfRmlsZVV0aWxzLmMuc2FtcGxlLXBy b3ZpZGVyLWJ1ZmZlci1vdmVyZmxvd3MgcGVnYXN1cy9zcmMvU0RLL3NhbXBsZXMvUHJvdmlkZXJz L0NNUEkvRmlsZXNBbmREaXJlY3Rvcmllcy9DV1NfRmlsZVV0aWxzLmMKKy0tLSBwZWdhc3VzL3Ny Yy9TREsvc2FtcGxlcy9Qcm92aWRlcnMvQ01QSS9GaWxlc0FuZERpcmVjdG9yaWVzL0NXU19GaWxl VXRpbHMuYy5zYW1wbGUtcHJvdmlkZXItYnVmZmVyLW92ZXJmbG93cwkyMDI2LTA3LTMxIDA5OjA3 OjM4LjA1MDc1MDA0MSArMDIwMAorKysrIHBlZ2FzdXMvc3JjL1NESy9zYW1wbGVzL1Byb3ZpZGVy cy9DTVBJL0ZpbGVzQW5kRGlyZWN0b3JpZXMvQ1dTX0ZpbGVVdGlscy5jCTIwMjYtMDctMzEgMDk6 MDY6NTQuODA4OTY1OTY1ICswMjAwCitAQCAtMTU0LDcgKzE1NCw5IEBAIGludCBtYWtlRmlsZUJ1 Zihjb25zdCBDTVBJSW5zdGFuY2UgKmluc3QKKyAgICAgZHQ9Q01HZXRQcm9wZXJ0eShpbnN0YW5j ZSwiTmFtZSIsJnJjKTsKKyAgICAgaWYgKHJjLnJjID09IENNUElfUkNfT0spCisgICAgIHsKKy0g ICAgc3RyY3B5KGN3c2YtPmN3c19uYW1lLENNR2V0Q2hhcnNQdHIoZHQudmFsdWUuc3RyaW5nLE5V TEwpKTsKKysgICAgc3RybmNweShjd3NmLT5jd3NfbmFtZSxDTUdldENoYXJzUHRyKGR0LnZhbHVl LnN0cmluZyxOVUxMKSwKKysgICAgICAgIHNpemVvZihjd3NmLT5jd3NfbmFtZSkgLSAxKTsKKysg ICAgY3dzZi0+Y3dzX25hbWVbc2l6ZW9mKGN3c2YtPmN3c19uYW1lKSAtIDFdID0gJ1wwJzsKKyAg ICAgfQorICAgICBkdD1DTUdldFByb3BlcnR5KGluc3RhbmNlLCJGaWxlU2l6ZSIsJnJjKTsKKyAg ICAgaWYgKHJjLnJjID09IENNUElfUkNfT0spCgpkaWZmIC0tZ2l0IGEvdG9nLXBlZ2FzdXMuc3Bl YyBiL3RvZy1wZWdhc3VzLnNwZWMKaW5kZXggMGRlMTE4YS4uNWY2NmIwYiAxMDA2NDQKLS0tIGEv dG9nLXBlZ2FzdXMuc3BlYworKysgYi90b2ctcGVnYXN1cy5zcGVjCkBAIC02LDcgKzYsNyBAQAog CiBOYW1lOiAgICAgICAgICAgdG9nLXBlZ2FzdXMKIFZlcnNpb246ICAgICAgICAle21ham9yX3Zl cn0uNAotUmVsZWFzZTogICAgICAgIDElez9kaXN0fQorUmVsZWFzZTogICAgICAgIDIlez9kaXN0 fQogRXBvY2g6ICAgICAgICAgIDIKIFN1bW1hcnk6ICAgICAgICBPcGVuUGVnYXN1cyBXQkVNIFNl cnZpY2VzIGZvciBMaW51eAogCkBAIC0xMTMsNiArMTEzLDggQEAgUGF0Y2gzMTogICAgICAgIHBl Z2FzdXMtMi4xNC4xLXNzbC1jZXJ0cy1nZW4tY2hhbmdlcy5wYXRjaAogUGF0Y2gzMjogICAgICAg IHBlZ2FzdXMtMi4xNC4xLXBvc3QtcXVhbnR1bS5wYXRjaAogIyBmaXggT3BlblNTTCA0LjAgY29t cGF0aWJpbGl0eQogUGF0Y2gzMzogICAgICAgIHBlZ2FzdXMtMi4xNC4xLW9wZW5zc2wtNC4wLWZp eC5wYXRjaAorIyBmaXggYnVmZmVyIG92ZXJmbG93cyBpbiBzYW1wbGUgQ01QSSBwcm92aWRlcnMg KENXRS0xMjApCitQYXRjaDM0OiAgICAgICAgcGVnYXN1cy0yLjE0LjQtc2FtcGxlLXByb3ZpZGVy LWJ1ZmZlci1vdmVyZmxvd3MucGF0Y2gKIAogQnVpbGRSZXF1aXJlczogIGxpYnN0ZGMrKywgcGFt LWRldmVsCiBCdWlsZFJlcXVpcmVzOiAgb3BlbnNzbCwgb3BlbnNzbC1kZXZlbApAQCAtMjc1LDYg KzI3Nyw3IEBAIHllcyB8IHBlZ2FzdXMvbWFrL0NyZWF0ZURtdGZTY2hlbWEgMjM4ICV7X2J1aWxk ZGlyfS9jaW1fc2NoZW1hXzIuMzguMC1NT0ZzLnppcCBjCiAlcGF0Y2ggLVAzMSAtcDAgLWIgLnNz bC1jZXJ0cy1nZW4tY2hhbmdlcwogJXBhdGNoIC1QMzIgLXAwIC1iIC5wb3N0LXF1YW50dW0KICVw YXRjaCAtUDMzIC1wMCAtYiAub3BlbnNzbC00LjAtZml4CislcGF0Y2ggLVAzNCAtcDAgLWIgLnNh bXBsZS1wcm92aWRlci1idWZmZXItb3ZlcmZsb3dzCiAKIAogJWJ1aWxkCkBAIC01NzYsNiArNTc5 LDkgQEAgZmkKIAogCiAlY2hhbmdlbG9nCisqIEZyaSBKdWwgMzEgMjAyNiBWaXRlenNsYXYgQ3Jo b25layA8dmNyaG9uZWtAcmVkaGF0LmNvbT4gLSAyOjIuMTQuNC0yCistIEZpeCBidWZmZXIgb3Zl cmZsb3dzIGluIHNhbXBsZSBDTVBJIHByb3ZpZGVycyAoQ1dFLTEyMCkKKwogKiBUdWUgSnVsIDIx IDIwMjYgVml0ZXpzbGF2IENyaG9uZWsgPHZjcmhvbmVrQHJlZGhhdC5jb20+IC0gMjoyLjE0LjQt MQogLSBVcGRhdGUgdG8gdXBzdHJlYW0gdmVyc2lvbiAyLjE0LjQKIAo=