diff mbox series

[meta-oe,wrynose,4/4] thrift: fix CVE-2026-55970

Message ID 20260907102107.4007371-5-Abhishek.Bachiphale@windriver.com
State New
Headers show
Series thrift: fix multiple CVEs | expand

Commit Message

Abhishek Bachiphale Sept. 7, 2026, 10:21 a.m. UTC
Buffer Over-read vulnerability in Apache Thrift C++ bindings. This
issue affects Apache Thrift: before 0.24.0.

Backport patch to fix CVE-2026-55970.

Reference:
[https://nvd.nist.gov/vuln/detail/cve-2026-55970]

Upstream Patch:
[https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
---
 .../thrift/thrift/CVE-2026-55970.patch        | 64 +++++++++++++++++++
 .../thrift/thrift_0.22.0.bb                   |  1 +
 2 files changed, 65 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch
new file mode 100644
index 0000000000..a58d109600
--- /dev/null
+++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch
@@ -0,0 +1,64 @@ 
+From 4da36faeef0b7db4b1dea560b01eb15957335934 Mon Sep 17 00:00:00 2001
+From: dxbjavid <dxbjavid@gmail.com>
+Date: Sat, 13 Jun 2026 17:39:53 +0530
+Subject: [PATCH] fix off-by-ten header bounds check in readHeaderFormat
+
+Dropped the upstream ThrifttReadCheckTests.cpp #include hunk as
+<thrift/transport/THeaderTransport.h> is already present in the 0.22.0
+sources; context adjusted to apply on 0.22.0.
+
+CVE: CVE-2026-55970
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934]
+Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
+---
+ .../src/thrift/transport/THeaderTransport.cpp |  5 +++-
+ lib/cpp/test/ThrifttReadCheckTests.cpp        | 23 +++++++++++++++++++
+ 2 files changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+index 70510d95c45..cdf29cf3d53 100644
+--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp
++++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+@@ -210,7 +210,10 @@ void THeaderTransport::readHeaderFormat(uint16_t headerSize, uint32_t sz) {
+   }
+   headerSize *= 4;
+   const uint8_t* const headerBoundary = ptr + headerSize;
+-  if (headerSize > sz) {
++  // ptr already skips the 10-byte common header, so the header section has to
++  // fit in the remaining sz - 10 bytes; comparing against sz alone let the
++  // boundary sit up to 10 bytes past the receive buffer.
++  if (headerSize > sz - 10) {
+     throw TTransportException(TTransportException::CORRUPTED_DATA,
+                               "Header size is larger than frame");
+   }
+diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp
+index d62f66330ad..7abcff8bd32 100644
+--- a/lib/cpp/test/ThrifttReadCheckTests.cpp
++++ b/lib/cpp/test/ThrifttReadCheckTests.cpp
+@@ -393,4 +393,26 @@ BOOST_AUTO_TEST_CASE(test_tthriftjsonprotocol_read_check_exception) {
+   BOOST_CHECK(out == payload);
+ }
+ 
++BOOST_AUTO_TEST_CASE(test_theadertransport_header_size_exceeds_frame) {
++  using apache::thrift::transport::THeaderTransport;
++  // Header-format frame whose declared header size (3 * 4 = 12) leaves fewer
++  // than the 10 common-header bytes inside the 14-byte frame. The trailing
++  // varint bytes are all continuation bytes, so the reader used to run off the
++  // end of the receive buffer.
++  uint8_t frame[] = {
++      0x00, 0x00, 0x00, 0x0E, // frame length = 14
++      0x0F, 0xFF, 0x00, 0x00, // header magic
++      0x00, 0x00, 0x00, 0x00, // seqId
++      0x00, 0x03,             // header size field (3 -> 12 bytes)
++      0x02,                   // protocol id varint
++      0x00,                   // num transforms = 0
++      0x80, 0x80              // info-header varint, all continuation
++  };
++  std::shared_ptr<TMemoryBuffer> buffer(new TMemoryBuffer(frame, sizeof(frame)));
++  std::shared_ptr<THeaderTransport> trans(new THeaderTransport(buffer));
++
++  uint8_t out[1];
++  BOOST_CHECK_THROW(trans->read(out, sizeof(out)), TTransportException);
++}
++
+ BOOST_AUTO_TEST_SUITE_END()
diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
index b68dacc806..b1178a55c1 100644
--- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
+++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
@@ -22,6 +22,7 @@  SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
            file://CVE-2026-48586-01.patch \
            file://CVE-2026-48586-02.patch \
            file://CVE-2026-48145.patch \
+           file://CVE-2026-55970.patch \
            "
 SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"