[rpms/tog-pegasus] rawhide: Fix buffer overflows in sample CMPI providers

[rpms/tog-pegasus] rawhide: Fix buffer overflows in sample CMPI providers

[Vitezslav Crhonek]

A new commit has been pushed.

Repo   : rpms/tog-pegasus
Branch : rawhide
Commit : 44ab874fc3fe2f45155d477412bc1201b050a75f
Author : Vitezslav Crhonek <vcrhonek@redhat.com>
Date   : 2026-07-31T10:08:49+02:00
Stats  : +68/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/tog-pegasus/c/44ab874fc3fe2f45155d477412bc1201b050a75f?branch=rawhide

Log:
Fix buffer overflows in sample CMPI providers

---
diff --git a/pegasus-2.14.4-sample-provider-buffer-overflows.patch b/pegasus-2.14.4-sample-provider-buffer-overflows.patch
new file mode 100644
index 0000000..ac17d38
--- /dev/null
+++ b/pegasus-2.14.4-sample-provider-buffer-overflows.patch
@@ -0,0 +1,61 @@
+diff -up pegasus/src/Providers/sample/CMPI/FilesAndDirectories/CWS_FileUtils.c.sample-provider-buffer-overflows pegasus/src/Providers/sample/CMPI/FilesAndDirectories/CWS_FileUtils.c
+--- pegasus/src/Providers/sample/CMPI/FilesAndDirectories/CWS_FileUtils.c.sample-provider-buffer-overflows	2026-07-31 09:07:36.988755691 +0200
++++ pegasus/src/Providers/sample/CMPI/FilesAndDirectories/CWS_FileUtils.c	2026-07-31 09:06:48.636996452 +0200
+@@ -157,7 +157,9 @@ int makeFileBuf(const CMPIInstance *inst
+         // Name needs be valid before copied using strcpy
+         if (CMPI_goodValue == dt.state)
+         {
+-            strcpy(cwsf->cws_name,CMGetCharsPtr(dt.value.string,NULL));
++            strncpy(cwsf->cws_name,CMGetCharsPtr(dt.value.string,NULL),
++                sizeof(cwsf->cws_name) - 1);
++            cwsf->cws_name[sizeof(cwsf->cws_name) - 1] = '\0';
+         }
+     }
+     dt=CMGetProperty(instance,"FileSize",&rc);
+diff -up pegasus/src/Providers/sample/CMPI/MethodProvider/cmpiMethodProvider.c.sample-provider-buffer-overflows pegasus/src/Providers/sample/CMPI/MethodProvider/cmpiMethodProvider.c
+--- pegasus/src/Providers/sample/CMPI/MethodProvider/cmpiMethodProvider.c.sample-provider-buffer-overflows	2026-07-31 09:07:37.341753813 +0200
++++ pegasus/src/Providers/sample/CMPI/MethodProvider/cmpiMethodProvider.c	2026-07-31 09:06:50.065989395 +0200
+@@ -97,8 +97,10 @@ CMPIStatus SampleCMPIMethodProviderInvok
+                 if(data.type == CMPI_string &&  !(CMIsNullValue(data)))
+                 {
+                     strCat = CMGetCharsPtr(data.value.string, &rc);
+-                    strcat(result, strCat);
+-                    strcat(result, "!");
++                    strncat(result, strCat,
++                        sizeof(result) - strlen(result) - 1);
++                    strncat(result, "!",
++                        sizeof(result) - strlen(result) - 1);
+                     /* create the new string to return to client */
+                     str1 = CMNewString(_broker, result, &rc);
+                     val1.string = str1;
+diff -up pegasus/src/Providers/sample/CMPI/SampleClass/CMPISampleClass.c.sample-provider-buffer-overflows pegasus/src/Providers/sample/CMPI/SampleClass/CMPISampleClass.c
+--- pegasus/src/Providers/sample/CMPI/SampleClass/CMPISampleClass.c.sample-provider-buffer-overflows	2026-07-31 09:07:37.702751892 +0200
++++ pegasus/src/Providers/sample/CMPI/SampleClass/CMPISampleClass.c	2026-07-31 09:06:52.710976329 +0200
+@@ -305,10 +305,9 @@ CMPIStatus testProvInvokeMethod
+ #ifdef PEGASUS_DEBUG
+   fprintf (stderr, "+++ testProvInvokeMethod()\n");
+ #endif
+-  strcpy (data, "hallo! dir: ");
+-  strcat (data, (char *) (CMGetArg (in, "dir", &rc).value.string->hdl));
+-  strcat (data, " type: ");
+-  strcat (data, (char *) (CMGetArg (in, "type", &rc).value.string->hdl));
++  snprintf (data, sizeof(data), "hallo! dir: %s type: %s",
++    (char *) (CMGetArg (in, "dir", &rc).value.string->hdl),
++    (char *) (CMGetArg (in, "type", &rc).value.string->hdl));
+ 
+   CMReturnData (rslt, data, CMPI_chars);
+   CMReturnDone (rslt);
+diff -up pegasus/src/SDK/samples/Providers/CMPI/FilesAndDirectories/CWS_FileUtils.c.sample-provider-buffer-overflows pegasus/src/SDK/samples/Providers/CMPI/FilesAndDirectories/CWS_FileUtils.c
+--- pegasus/src/SDK/samples/Providers/CMPI/FilesAndDirectories/CWS_FileUtils.c.sample-provider-buffer-overflows	2026-07-31 09:07:38.050750041 +0200
++++ pegasus/src/SDK/samples/Providers/CMPI/FilesAndDirectories/CWS_FileUtils.c	2026-07-31 09:06:54.808965965 +0200
+@@ -154,7 +154,9 @@ int makeFileBuf(const CMPIInstance *inst
+     dt=CMGetProperty(instance,"Name",&rc);
+     if (rc.rc == CMPI_RC_OK)
+     {
+-    strcpy(cwsf->cws_name,CMGetCharsPtr(dt.value.string,NULL));
++    strncpy(cwsf->cws_name,CMGetCharsPtr(dt.value.string,NULL),
++        sizeof(cwsf->cws_name) - 1);
++    cwsf->cws_name[sizeof(cwsf->cws_name) - 1] = '\0';
+     }
+     dt=CMGetProperty(instance,"FileSize",&rc);
+     if (rc.rc == CMPI_RC_OK)

diff --git a/tog-pegasus.spec b/tog-pegasus.spec
index 0de118a..5f66b0b 100644
--- a/tog-pegasus.spec
+++ b/tog-pegasus.spec
@@ -6,7 +6,7 @@
 
 Name:           tog-pegasus
 Version:        %{major_ver}.4
-Release:        1%{?dist}
+Release:        2%{?dist}
 Epoch:          2
 Summary:        OpenPegasus WBEM Services for Linux
 
@@ -113,6 +113,8 @@ Patch31:        pegasus-2.14.1-ssl-certs-gen-changes.patch
 Patch32:        pegasus-2.14.1-post-quantum.patch
 # fix OpenSSL 4.0 compatibility
 Patch33:        pegasus-2.14.1-openssl-4.0-fix.patch
+# fix buffer overflows in sample CMPI providers (CWE-120)
+Patch34:        pegasus-2.14.4-sample-provider-buffer-overflows.patch
 
 BuildRequires:  libstdc++, pam-devel
 BuildRequires:  openssl, openssl-devel
@@ -275,6 +277,7 @@ yes | pegasus/mak/CreateDmtfSchema 238 %{_builddir}/cim_schema_2.38.0-MOFs.zip c
 %patch -P31 -p0 -b .ssl-certs-gen-changes
 %patch -P32 -p0 -b .post-quantum
 %patch -P33 -p0 -b .openssl-4.0-fix
+%patch -P34 -p0 -b .sample-provider-buffer-overflows
 
 
 %build
@@ -576,6 +579,9 @@ fi
 
 
 %changelog
+* Fri Jul 31 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.4-2
+- Fix buffer overflows in sample CMPI providers (CWE-120)
+
 * Tue Jul 21 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.4-1
 - Update to upstream version 2.14.4