[rpms/sblim-sfcb] f45: Fix CVE-2026-73583 and CVE-2026-73584

[Vitezslav Crhonek <vcrhonek@redhat.com>]

A new commit has been pushed.

Repo   : rpms/sblim-sfcb
Branch : f45
Commit : 9ff7e331ab780a234a4bfe938146438b52d19619
Author : Vitezslav Crhonek <vcrhonek@redhat.com>
Date   : 2026-09-07T10:25:24+02:00
Stats  : +124/-1 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/sblim-sfcb/c/9ff7e331ab780a234a4bfe938146438b52d19619?branch=f45

Log:
Fix CVE-2026-73583 and CVE-2026-73584

---
diff --git a/sblim-sfcb-1.4.9-secure-tmpfile.patch b/sblim-sfcb-1.4.9-secure-tmpfile.patch
new file mode 100644
index 0000000..4ceb89d
--- /dev/null
+++ b/sblim-sfcb-1.4.9-secure-tmpfile.patch
@@ -0,0 +1,55 @@
+diff -up sblim-sfcb-1.4.9/sfcbrepos.sh.in.secure-tmpfile sblim-sfcb-1.4.9/sfcbrepos.sh.in
+--- sblim-sfcb-1.4.9/sfcbrepos.sh.in.secure-tmpfile	2026-07-29 11:58:54.171124696 +0200
++++ sblim-sfcb-1.4.9/sfcbrepos.sh.in	2026-07-29 11:56:15.272018480 +0200
+@@ -170,7 +170,9 @@ then
+     fi
+ 
+     # Compile all staged namespace directories
+-    instmigfile=/tmp/sfcbinst.mof
++    instmigfile="$(mktemp "${TMPDIR:-/tmp}/sfcbinst.XXXXXX.mof")" || exit 1
++    chmod 600 "$instmigfile" || exit 1
++    trap 'rm -f -- "$instmigfile"' EXIT
+     mofsubdirs=`find $stagingdir/mofs/* -type d -print 2> /dev/null`
+     if ls $stagingdir/mofs/*.mof > /dev/null 2>&1
+     then
+@@ -186,21 +188,21 @@ then
+ 	    repositorydir=$registrationdir/repository/
+ 	    [ -d $repositorydir ] || mkdir -p $repositorydir
+ 
+-        #grab all non-mof static instances, output to /tmp/sfcbinst.mof
++        #grab all non-mof static instances, output to temp file
+         if [ -z "$ignore_instances" ]
+         then
+-            rm -f $instmigfile 2> /dev/null
++            : > "$instmigfile"
+             #get class names (from filenames), ignoring specific files, from repos.previous, as it's already been moved
+             if [ -e $registrationdir/repository.previous/$namespace/ ]
+             then
+                 static_inst_files=`ls $registrationdir/repository.previous/$namespace/ -I classSchemas -I qualifiers -I *.idx` > /dev/null 2>&1
+                 for instfile in $static_inst_files
+                 do
+-                    sfcbinst2mof -n $namespace -c $instfile -o $instmigfile -r $registrationdir/repository.previous/ -g ${DESTDIR}@sysconfdir@/sfcb/sfcb.cfg 2> /dev/null
++                    sfcbinst2mof -n "$namespace" -c "$instfile" -o "$instmigfile" -r "$registrationdir/repository.previous/" -g "${DESTDIR}@sysconfdir@/sfcb/sfcb.cfg" 2> /dev/null
+                 done
+             fi
+         fi
+-        if [ -e $instmigfile ]
++        if [ -s "$instmigfile" ]
+         then
+             instmigopt="-m $instmigfile"
+         else
+@@ -208,14 +210,9 @@ then
+         fi
+ 	    if ! sfcbmof -d $repositorydir -n $namespace -o classSchemas -I $cimschemadir -i CIM_Schema.mof $cpformat $backendopt $instmigopt $mofdir/*.mof $globalmofs
+ 	    then
+-            rm -f $instmigfile 2> /dev/null
+ 		    echo Failed compiling the MOF files. >&2
+ 		    exit 1
+ 	    fi
+-        if [ -e $instmigfile ]
+-        then
+-            rm -f $instmigfile 2> /dev/null
+-        fi
+ 
+         if [ "$compress" = "1" ]
+         then

diff --git a/sblim-sfcb-1.4.9-validate-ipc-msg.patch b/sblim-sfcb-1.4.9-validate-ipc-msg.patch
new file mode 100644
index 0000000..66fc206
--- /dev/null
+++ b/sblim-sfcb-1.4.9-validate-ipc-msg.patch
@@ -0,0 +1,51 @@
+diff -up sblim-sfcb-1.4.9/providerMgr.c.validate-ipc-msg sblim-sfcb-1.4.9/providerMgr.c
+--- sblim-sfcb-1.4.9/providerMgr.c.validate-ipc-msg	2026-07-29 09:41:36.973038191 +0200
++++ sblim-sfcb-1.4.9/providerMgr.c	2026-07-29 09:47:02.157247192 +0200
+@@ -24,6 +24,7 @@
+ #include <time.h>
+ #include <pthread.h>
+ #include <sys/resource.h>
++#include <stdint.h>
+ 
+ #include "cmpi/cmpidt.h"
+ #include "providerRegister.h"
+@@ -1003,6 +1004,18 @@ static MgrHandler mHandlers[] = {
+   {notSupported}                // OPS_EnumerationCount 43
+ };
+ 
++static int
++segInMsg(unsigned long rl, MsgSegment seg)
++{
++  uintptr_t off = (uintptr_t) seg.data;
++  size_t len = (size_t) seg.length;
++  if (off > rl)
++    return 0;
++  if (len > (size_t)(rl - off))
++    return 0;
++  return 1;
++}
++
+ void
+ processProviderMgrRequests()
+ {
+@@ -1068,6 +1081,20 @@ processProviderMgrRequests()
+          spRecvReq(&sfcbSockets.receive, &requestor, (void **) &req, &rl,
+                    &mqg)) == 0) {
+       if (mqg.rdone) {
++        if (rl < sizeof(OperationHdr) ||
++            !segInMsg(rl, req->nameSpace) ||
++            (req->className.length && !segInMsg(rl, req->className)) ||
++            req->type >= (sizeof(mHandlers) / sizeof(mHandlers[0])) ||
++            mHandlers[req->type].handler == NULL) {
++          mlogf(M_ERROR, M_SHOW,
++                "--- Mgr request rejected: invalid message "
++                "(len=%lu)\n", rl);
++          free(req);
++          if ((options & OH_Internal) == 0)
++            close(requestor);
++          continue;
++        }
++
+         req->nameSpace.data =
+             (void *) ((long) req->nameSpace.data + (char *) req);
+         if (req->className.length)

diff --git a/sblim-sfcb.spec b/sblim-sfcb.spec
index 06be50e..631a2d6 100644
--- a/sblim-sfcb.spec
+++ b/sblim-sfcb.spec
@@ -8,7 +8,7 @@ Name: sblim-sfcb
 Summary: Small Footprint CIM Broker
 URL: http://sblim.wiki.sourceforge.net/
 Version: 1.4.9
-Release: 43%{?dist}
+Release: 44%{?dist}
 License: EPL-1.0
 Source0: http://downloads.sourceforge.net/sblim/%{name}-%{version}.tar.bz2
 Source1: sfcb.service
@@ -58,6 +58,15 @@ Patch15: sblim-sfcb-1.4.9-fix-ftell-overflow.patch
 Patch16: sblim-sfcb-1.4.9-fix-double-free.patch
 # Patch17: fix incorrect free of non-allocated pointer
 Patch17: sblim-sfcb-1.4.9-fix-incorrect-free.patch
+# Patch18: validate IPC message fields in processProviderMgrRequests() before
+#   pointer fixup and handler dispatch to prevent OOB access via malformed
+#   OperationHdr (CVE-2026-73583)
+Patch18: sblim-sfcb-1.4.9-validate-ipc-msg.patch
+# Patch19: use mktemp for sfcbrepos instance migration temp file to prevent
+#   TOCTOU symlink attack via /tmp/sfcbinst.mof (CVE-2026-73584)
+Patch19: sblim-sfcb-1.4.9-secure-tmpfile.patch
+
+
 Provides: cim-server = 0
 Requires: cim-schema
 Requires: sblim-sfcCommon
@@ -105,6 +114,8 @@ Programming Interface (CMPI).
 %patch -P15 -p1 -b .fix-ftell-overflow
 %patch -P16 -p1 -b .fix-double-free
 %patch -P17 -p1 -b .fix-incorrect-free
+%patch -P18 -p1 -b .validate-ipc-msg
+%patch -P19 -p1 -b .secure-tmpfile
 
 # Create a sysusers.d config file
 cat >sblim-sfcb.sysusers.conf <<EOF
@@ -173,6 +184,12 @@ fi
 %{_tmpfilesdir}/sblim-sfcb.conf
 
 %changelog
+* Mon Sep 07 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-44
+- Validate IPC message in provider-manager to prevent OOB access
+  via malformed OperationHdr (CVE-2026-73583)
+- Use mktemp for sfcbrepos instance migration temp file to prevent
+  TOCTOU symlink attack via /tmp/sfcbinst.mof (CVE-2026-73584)
+
 * Wed Jul 22 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-43
 - Fix multiple issues discovered by static analysis