From patchwork Mon Sep 7 07:42:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 97450 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C324C79FA0 for ; Mon, 7 Sep 2026 07:49:01 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.65]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29640.1788766964563572350 for ; Mon, 07 Sep 2026 00:42:46 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=wuUbCaGv; spf=pass (domain: est.tech, ip: 52.101.69.65, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=PDqWLkn8qlakTr8coKR9rROQF5dT76XyJJfyqLxx3gt3pOIrp+0IqERakNd2+HxGawoa1eg6sxl6U/LXi2nAxX95mwZDotnGTw/qz6m3t0PnHo2BeZc8Wl/Fgfdlk9CIG3kM7u9zVyDPv5HI7/3F9uEWbmeCzugeonTthZexzwFFD6+ZgIEktXqIECxG4egHdQmSLuRu7pRowijHsoCsNzKHw7RdAGWQOk36DRVzEB18OGjNZbjKQo3hKgj5zAnf1ZE2qgTlioFOADK2sf1XwJbsBu+/sh2/ANVXLDl7xE2hMNCqqffIeIpPb8YWPrH8Zyp5rAiZB9Rg4Bua7+D5HA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=t6/aFX1ntZQzd7HFCEXuSSqH5l3BHA2iSZusyHM0GIE=; b=yQ/oiFXEYB7fkdAGpHNTvbZ+aDYVCXNakkmwHoc3QyR2bv/j5o8DGX6eLF8CXfDYMurqQMDa83GaWz4yzt+cphN7JyAxTtLuIrCiSFgZ9LaLuNmOl/hbtkQztEt42gQAr/fjulqEb4Daw0+etiC+vRwqkTbv1Bu90lqGk4NzL8yuQ46K1nZhWVrczbaHwZR6QhcUMOlYj/LIbAGyIbIc6vq1HpIYrEPueQLZVBDlaR85vXQvAfnq2tVkjT+t13UFfpW4QKTCx0UY6PJ6BHw2FS/Id21Z/xFvaYwU+/NWwBgcGpNKC0Y1/M/KU/OTo4qD4VI74t2isWXwd1cJyV+dSQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=t6/aFX1ntZQzd7HFCEXuSSqH5l3BHA2iSZusyHM0GIE=; b=wuUbCaGvDspgE8MozQHSOpv3UJQuObxfI3WukXpsikXUg3AJVIxAP6s/uRiWB2nXnOGz9ldO6OWAgcMBv49HDNRU8PXy586rqV0VrdDSW1RRBVNC/rngtjcOgqcryIVh7bUEbp3HVXfKwjZQbvntKdX97yepOI91Tcdq09O3mckmZUeUjqj4UnditoPsAULBAn/liD62xuVWkNW7v9/cg+kKHkATiD5uSd/vPJP6+wcvtXyX0EFqRnQnl3BfEbDGYbu57lGl4cKOCpwU35xQlhAX7L0nRCh+FV5CG8DX4a6jaKPP3MN820rnpX73K55s5Mqa1oGPPayVI/OGnc2JlA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) by GV4P189MB3558.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b4::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 07:42:36 +0000 Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff]) by AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 07:42:35 +0000 From: "Adarsh Jagadish Kamini" To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][wrynose][PATCH 1/4] thrift: fix CVE-2026-41608 Date: Mon, 7 Sep 2026 09:42:17 +0200 Message-ID: <20260907074231.388316-1-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: LO4P123CA0204.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:1a5::11) To AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P189MB1672:EE_|GV4P189MB3558:EE_ X-MS-Office365-Filtering-Correlation-Id: e24ead26-56b0-4528-6222-08df0cb39590 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|23010399003|366016|1800799024|376014|10067099003|3023799007|18002099003|12006099003|56012099006|11063799006|13003099007; X-Microsoft-Antispam-Message-Info: m67M2DrdM4jDHcbKFtvKWEphYU/zjOu5b+jxTffN7asnzEVVh1r0GdPNSirXaMP0sG1W3THyWfL2rNAOPwT4Y5x+c14WnYGZYq/gqU5AS3c9kODZcjYRCqX6WBdHt9xzxc7RwwznQEvTPw2NLOdp3mHp2oEPnV4x7aZ9TihMjMPABgQv4w6Xzm1ZUQqcBqfE19Byqgpfm4ELsxf63M1LWuA0cbaCJ8Q1mylIaxN32RduKfliR8OU9B71UikxGmh6/T954ggTrmVbV8oTcw3eN41Adk8adbnd6Eopr3MlXDSJoPQ/h6rguipP2l007GGz9Bz7H6WFKdixY7LpygeGII+owF8Zt69y9YmKoc+OH0K5lVYqHj5cKM7CVQkmSLX826HhYyX2XjGbcaeFSVIiCfhtfB34QOWEpwKYRTY87BOGnGHz7ailEOPe1RnJ9nmx52jRu2oMEz7/MI5vJbcxHZNdDF4+XLUDFYJxni9bPfIoyMbHq9Wj/QJTpigjEUN6K168P0UK45BKXjugRYsTzdIM+TIjRBOrsUtpbqPxCaoxRDc1K3QdAXD1mYdiekSD8wnMVMKNhIeMK4A9JR1j7R1ayMNP8jHSxbCuj473lNi0V8W6SusH+eMuEI7yQJODjyTWS0lyfHXHguf1LQ5/utLpUomN+h8q72HpPfCFd6s= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P189MB1672.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(23010399003)(366016)(1800799024)(376014)(10067099003)(3023799007)(18002099003)(12006099003)(56012099006)(11063799006)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: tigmV3MmUgreD752R7QJ1/cdP4GST/egiJkmhHb8n92tUkhMwS4JG+TI9QxoaKQnk0TxU5TioROYtFFLxVoNOCl2LQEidnDWVQF5NkJcIn5y/kg5HhDvgVN4CA7CEs+MIFlSAwISpCjESXP0RoIcvxgFnPvrJw+mxLsFNn0SRki61vZdFsUlpGFLa0RtZL0iCLYI25EN8UXwTpxkm65/9mebLYiN5GmZHAgNBdZciHftxVxsCcXK1W0dvO1zqCOKHUdVMPym+UTNDfQIS0ftN4248uU6KF0ndMJlOz6cjpdE3TN2sI9wiOR+msOiX3BjTU/ZJ1UpnvJTG6ajGIv1zTaeQ4lPyeR+FpbUhMKr0HhhjTMkaRbintaBS1Ou5/jjo7oguBHyurgjCfIKkUN2uZq/KDQ2NMBLph8cEbNos1QI6LhxY06HhmuV4CXx0MDHrdN0N1z8ufWxaFZ44w3z1VBHTkylQu9TTQLmRia5quzyvaFyjSFcjpG5BTJT50hQqVy/pr032/8MMvj8ILSJjEz8sSk9tUO6/faIHsgdxK84Zdj3ksJKhPSp/eVIqW51ErSQAnOTbrQMxH8DI09tXkN+tXdOJrIMW+hT9hqdITMEtbBh1bJ+lpDGubwcCSVaoFQ0CwaQFQZf/YnR6h4bjIfZa0FswlQ4v1xEq4r0dGk8wholtoMcPwJz7wDDm+zO+ZlniA8zt0ZhnlrILhH577buLHs7t2c8sVvbf02FsP/WjaPJQDsfNZllfTI2VgUzkXX7mU1g7fHb5nMz+yX/91fcS57e98bC0s38dez4b3+GzxfNvQKNse7UeNAWvO0SIsdA5llyLoTDOjryNaLzkqTjIxIyNAbSEN6gp/USeWBloy0Ypn1evGvm1b1GqaCFp80Q/Df3qom6+mZJd5l6MdFLsj/Tb8Y5TUJSU2A1Q5wIHbqU5hSUjSZ4M7cOFqf8GpCwp/dO6JNsSHcwntx7o30XXYsuENVwu0At2lbeT5UoWb4gXb9J/J6VGHD+hDLJCW1fT9oHxoDZZeXoLypzTM98d28KiWR6fGhYD8yNuHYURAmft8FYhqsaPkmf3HWrz8pZkilqu7vAOPFZvCF279h6IlDw5FbzW3XcwCGSma5HRZfVGSE3uY+b8jTemyLEY7oyDsgnBkp08DjznqHlzDFFig+xDjMcAoZBA2u1nCBIMbM1KGu9TazwwG2xOr64paJpZMUZV/S/TRGLAJo7dG4sTNwVNBg0t4ghRaMty0EHBhyyhTR1fxSUJJ31GyQ3PRi9QDCKixik+BhHG+GEQlbSc49vEjIw5MtywdsQcBSpH3kj3dYDkSrVL4EQGtpCUGIwUtRiIp4HBmCDOJSQ2eQU8qDyZ4vX51jOvHDcNxNioFHZ+mbWQDJ+IaGuPCNHlCWBfOF8aSdfRr3lcHuDLBFlJE0YY4Zp1xJZxfum2WBeayEzR95zOTA5rt1c8uvhTuZ03jlmzFmrbNjo/E+jK/ePTS2jgH/opOTu9Ga3iOIaWnVzX18rQM/kJo3oMee1X3K0rx4KrSBbiOJACvNi5NSCv8UFFINaxh5vBdKh5PaUwsA5K6KMFyUc4Fs+6QaFDYggho7yobjIrv762OEgWnzH9Rr16EVch/JqXeeoLnHrIA5JpJvPR0uK+9xHDmTzb7xia2JAgOtfJNWm5lJ1j5qYFoDzfpzAFvcO542YhtXeysNW6Ng0Nu8bGw0CoF5JLKQIQLKhDIXz246+Qh9xIlPakw0bxNMnhvcCbR3/Nqd92uJq/qeK1x6ZsIhH/zChOrXImIol X-MS-Exchange-AntiSpam-MessageData-1: Ow/fUJ7/JO3tpIUXLQl1md4YLtn2JI0WxzyyecBiz8LaZ4e2iYzyhjwt X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: e24ead26-56b0-4528-6222-08df0cb39590 X-MS-Exchange-CrossTenant-AuthSource: AS8P189MB1672.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 07:42:35.8816 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: E5gLTtJLUs16kRcEbBzx1FgXTJjIgSM9Z+490+oPzBHRajnaxva4bQfeBgstdbHuIBOfZM7VPPiXD0zCXshZAzWnsJ03DYfrBY36EXyLIbY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3558 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 07 Sep 2026 07:49:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129806 Backport patch to fix CVE-2026-41608. References: https://nvd.nist.gov/vuln/detail/CVE-2026-41608 Upstream fix: https://github.com/apache/thrift/commit/8c605880ea4ef050a689c859de3b702ad8d4ce7b Signed-off-by: Adarsh Jagadish Kamini --- .../thrift/thrift/CVE-2026-41608.patch | 176 ++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 177 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-41608.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-41608.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-41608.patch new file mode 100644 index 0000000000..a65f0ac73b --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-41608.patch @@ -0,0 +1,176 @@ +From d6ef4cd811666ce8c72dd5417d95debce52f490b Mon Sep 17 00:00:00 2001 +From: Jens Geyer +Date: Sun, 19 Apr 2026 10:10:35 +0200 +Subject: [PATCH] Add decompressed payload size limit to Python + THeaderTransport Client: py + +Adds _max_decompressed_size (default: HARD_MAX_FRAME_SIZE) and +set_max_decompressed_size() to THeaderTransport. ZLIB decompression +now uses decompressobj with a size cap instead of unbounded +zlib.decompress(), consistent with the C++ implementation. + +Refactor THeaderTransport read-transform dispatch into _apply_read_transform + +Co-Authored-By: Claude Sonnet 4.6 + +CVE: CVE-2026-41608 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/8c605880ea4ef050a689c859de3b702ad8d4ce7b] + +Signed-off-by: Adarsh Jagadish Kamini +--- + lib/py/src/transport/THeaderTransport.py | 26 +++++++--- + lib/py/test/thrift_transport.py | 65 ++++++++++++++++++++++++ + 2 files changed, 85 insertions(+), 6 deletions(-) + +diff --git a/lib/py/src/transport/THeaderTransport.py b/lib/py/src/transport/THeaderTransport.py +index 4fb203430..51bc43cf7 100644 +--- a/lib/py/src/transport/THeaderTransport.py ++++ b/lib/py/src/transport/THeaderTransport.py +@@ -60,9 +60,7 @@ class THeaderTransformID(object): + ZLIB = 0x01 + + +-READ_TRANSFORMS_BY_ID = { +- THeaderTransformID.ZLIB: zlib.decompress, +-} ++KNOWN_READ_TRANSFORM_IDS = frozenset({THeaderTransformID.ZLIB}) + + + WRITE_TRANSFORMS_BY_ID = { +@@ -102,6 +100,7 @@ class THeaderTransport(TTransportBase, CReadableTransport): + self.sequence_id = 0 + self._protocol_id = default_protocol + self._max_frame_size = HARD_MAX_FRAME_SIZE ++ self._max_decompressed_size = HARD_MAX_FRAME_SIZE + + def isOpen(self): + return self._transport.isOpen() +@@ -135,6 +134,22 @@ class THeaderTransport(TTransportBase, CReadableTransport): + raise ValueError("maximum frame size should be < %d and > 0" % HARD_MAX_FRAME_SIZE) + self._max_frame_size = size + ++ def set_max_decompressed_size(self, size): ++ if not 0 < size <= HARD_MAX_FRAME_SIZE: ++ raise ValueError("maximum decompressed size should be <= %d and > 0" % HARD_MAX_FRAME_SIZE) ++ self._max_decompressed_size = size ++ ++ def _apply_read_transform(self, transform_id, payload): ++ if transform_id == THeaderTransformID.ZLIB: ++ decompressor = zlib.decompressobj() ++ payload = decompressor.decompress(payload, self._max_decompressed_size) ++ if decompressor.unconsumed_tail: ++ raise TTransportException( ++ TTransportException.SIZE_LIMIT, ++ "Decompressed payload exceeds maximum allowed size.", ++ ) ++ return payload ++ + @property + def protocol_id(self): + if self._client_type == THeaderClientType.HEADERS: +@@ -250,7 +265,7 @@ class THeaderTransport(TTransportBase, CReadableTransport): + transform_count = readVarint(buffer_transport) + for _ in range(transform_count): + transform_id = readVarint(buffer_transport) +- if transform_id not in READ_TRANSFORMS_BY_ID: ++ if transform_id not in KNOWN_READ_TRANSFORM_IDS: + raise TApplicationException( + TApplicationException.INVALID_TRANSFORM, + "Unknown transform: %d" % transform_id, +@@ -276,8 +291,7 @@ class THeaderTransport(TTransportBase, CReadableTransport): + + payload = buffer.read() + for transform_id in transforms: +- transform_fn = READ_TRANSFORMS_BY_ID[transform_id] +- payload = transform_fn(payload) ++ payload = self._apply_read_transform(transform_id, payload) + return BytesIO(payload) + + def write(self, buf): +diff --git a/lib/py/test/thrift_transport.py b/lib/py/test/thrift_transport.py +index cb1bb0ce7..cb0d815cb 100644 +--- a/lib/py/test/thrift_transport.py ++++ b/lib/py/test/thrift_transport.py +@@ -17,11 +17,17 @@ + # under the License. + # + ++import struct + import unittest ++import zlib + import os + + import _import_local_thrift # noqa + from thrift.transport import TTransport ++from thrift.transport.THeaderTransport import ( ++ THeaderTransport, THeaderClientType, THeaderTransformID, HEADER_MAGIC, ++) ++from thrift.transport.TTransport import TTransportException + + + class TestTFileObjectTransport(unittest.TestCase): +@@ -66,5 +72,64 @@ class TestMemoryBuffer(unittest.TestCase): + buffer_r.close() + + ++def _craft_zlib_header_frame(plain_payload): ++ """Return a complete THeaderTransport frame with a ZLIB-compressed payload.""" ++ compressed = zlib.compress(plain_payload) ++ # proto_id=0, 1 transform; values <128 encode as single varint bytes ++ hdr_content = bytes([0, 1, THeaderTransformID.ZLIB]) ++ padding = (4 - len(hdr_content) % 4) % 4 ++ hdr_bytes = hdr_content + b'\x00' * padding ++ header_len_u16 = len(hdr_bytes) // 4 ++ # 10 fixed bytes: 2(magic)+2(flags)+4(seqid)+2(hdr_len_u16) ++ frame_size = 10 + len(hdr_bytes) + len(compressed) ++ frame = struct.pack('!i', frame_size) ++ frame += struct.pack('!H', HEADER_MAGIC) ++ frame += struct.pack('!H', 0) # flags ++ frame += struct.pack('!i', 0) # sequence_id ++ frame += struct.pack('!H', header_len_u16) ++ frame += hdr_bytes ++ frame += compressed ++ return frame ++ ++ ++class TestTHeaderTransportDecompressionLimit(unittest.TestCase): ++ ++ def _make_transport(self, payload, max_decompressed_size=None): ++ frame = _craft_zlib_header_frame(payload) ++ inner = TTransport.TMemoryBuffer(frame) ++ transport = THeaderTransport(inner, [THeaderClientType.HEADERS]) ++ if max_decompressed_size is not None: ++ transport.set_max_decompressed_size(max_decompressed_size) ++ return transport ++ ++ def test_zlib_roundtrip(self): ++ payload = b'Hello Thrift! ' * 100 ++ t = self._make_transport(payload) ++ t.readFrame(1) ++ self.assertEqual(t._read_buffer.read(), payload) ++ ++ def test_decompression_bomb_blocked(self): ++ # 10,000 bytes decompressed; limit set to 1,000 ++ payload = b'A' * 10000 ++ t = self._make_transport(payload, max_decompressed_size=1000) ++ with self.assertRaises(TTransportException) as ctx: ++ t.readFrame(1) ++ self.assertEqual(ctx.exception.type, TTransportException.SIZE_LIMIT) ++ ++ def test_payload_at_limit_passes(self): ++ payload = b'B' * 5000 ++ t = self._make_transport(payload, max_decompressed_size=5000) ++ t.readFrame(1) ++ self.assertEqual(t._read_buffer.read(), payload) ++ ++ def test_set_max_decompressed_size_rejects_invalid(self): ++ inner = TTransport.TMemoryBuffer(b'') ++ t = THeaderTransport(inner, [THeaderClientType.HEADERS]) ++ with self.assertRaises(ValueError): ++ t.set_max_decompressed_size(0) ++ with self.assertRaises(ValueError): ++ t.set_max_decompressed_size(-1) ++ ++ + if __name__ == '__main__': + unittest.main() diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb index 0128de8519..b5dee9bd00 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb @@ -17,6 +17,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://CVE-2026-58023.patch \ file://CVE-2026-48144.patch \ file://CVE-2026-58389.patch \ + file://CVE-2026-41608.patch \ " SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5" From patchwork Mon Sep 7 07:42:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 97448 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26324C79F89 for ; Mon, 7 Sep 2026 07:48:41 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.65]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29640.1788766964563572350 for ; Mon, 07 Sep 2026 00:42:45 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=JuBBycLH; spf=pass (domain: est.tech, ip: 52.101.69.65, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Ky8O4WTR5OnULc2HUaZJoGBLoFJ+iag4jHDu9cxucJ9loUs6KWBoPNSveGjCaI9HIRBzPPNWThEfFXUXUeAA59fRijHXSQBBMMTjeAvq17GNLSb7jKuF/SKOBIYB6RlAoRejU9Z62O1Z4TeFa7IyCMh4Ab2ezb1A9u9r4yHbl3aRxCe/eIupLa9lwixqlnPGxR4jm0eq7q5KyfHbzKs9gwyN81sJnsnFqCMKwvbupSl+sgAn9Kka98gig39DtlOVyGmCdtodEBmusKLFxdNRlSnQutnXeULMk2J9dlPbGWVhdiTbOWxeEkBIQ+bITgUJVED7m967wmEXngUkiKCIdA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=QzFeVZ2QdepWDtl/9OsK6w5x4bFyp31muuVyxK3h2Co=; b=bosR+xcX2i1fLqp4IPWM6k+FKN5ocrFmgFm8ywSs5vTGJupC+k9vdlcVrD6zdHtO6cDQT6jOgnkJd9BY/QZASO3xW0gHAEZOa/l91HJlaRHSUH5O34s/S+l6YCYF6GWIq8vJk0tyOasaVqkOadobHwhWFP2kF2q/yQC/irrcFgKQGnFx19jBIKIa03veewHBpw1XWUpQQNIG13lIelAZYTG74Cnte/vGIYmm2pDH+3NVq6iuJeBHtdArG7uDqgVy/A+MsuLS0kf8q5Ety5mCxffz/d9JBikwyJMyBuSwhfRXyqimv3nBQ28uZoHPMWFCCvBOJL0MlSNsuibA4JGdIA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QzFeVZ2QdepWDtl/9OsK6w5x4bFyp31muuVyxK3h2Co=; b=JuBBycLHJsGEzDybOJ+D9I4gkWyzQo/Novrv3ie17rKV1LGolYIcDOGM4jwhhw4njGvxlAEnRnFykGdbExOoIipVFMWbpXGilKAHW0CvJIsEQ7O1Vudv7fOfM+oZV9v7+7edlDkaPL9vwW0KG0QmYP005XC8dHPKzOCAXjwlG+pPTJRJQwWjvyfnmJehqmJgVnzU/1iepyctOoajJuXkQnKqbC6R7jzStsDLofbRuWVbsu8lR70fAERFkzMXaRVMJNE5cwCat894BtJhPt8JmxgSPLAQq9t+ppujAPnBZltbsZRjwmXedlZSSD7N2X0Nhe4O9jbB77Q33G67aP0RMA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) by GV4P189MB3558.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b4::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 07:42:37 +0000 Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff]) by AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 07:42:37 +0000 From: "Adarsh Jagadish Kamini" To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][wrynose][PATCH 2/4] thrift: fix CVE-2026-45112 Date: Mon, 7 Sep 2026 09:42:18 +0200 Message-ID: <20260907074231.388316-2-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260907074231.388316-1-adarsh.jagadish.kamini@est.tech> References: <20260907074231.388316-1-adarsh.jagadish.kamini@est.tech> X-ClientProxiedBy: LO4P265CA0201.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:318::10) To AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P189MB1672:EE_|GV4P189MB3558:EE_ X-MS-Office365-Filtering-Correlation-Id: c667ccea-a6e2-43e7-2827-08df0cb39694 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|23010399003|366016|1800799024|376014|10067099003|6133799003|3023799007|22082099003|18002099003|12006099003|56012099006|11063799006|13003099007; X-Microsoft-Antispam-Message-Info: WEEap+0Z2G4qO9W8B+ymC96sf9AWbcwlswDtkIMv23IucJoYi2D4bRlfxF0Qi/JAIdWoayugbfJ8/g7Jw0jXtMc/ommrro2cyFj/GVQf7n1ZkA2SsfRxaXKOl1UIdS20VRI+UJDTNppaNnmQXealWgGeihQOH3CX2WTyN1NgjMRnK4HrDA2PzyUn1ZkvbBTJ3WwJp5DN073JK9coXTVIqGnwMCZ+uTnbA4ptBins3loLCstkf/vx/4KttDyMjCg+5D+5ar1loWrh9HKXF38oDkGcrZAEugkS52PR7+tTHxp7tKA3Q/TVzPM6XKGKu9F8DAUcYo+snpeo5HNV9UhKJLZHZE7vQXuljioJ4TTkWU+0DTsSYUR4VcvN5Rm5UDnfEuUYMi3VpghKdpg8PhrKSlpO85i7/RleZKCZah7vJ57Y9bZUmpNfHKAbE4Fs8T0XhCBzEDcJNy4hbAuBbo90poMM2CyRF+R7e5AjqknEnPh7rgm/ri+2hlW3aEpPJesFxdCS1nTMsgr7sQIwaGvkKlA6TXOxB1qdh60J96Wr+mPhQ2qFV5PPidlwakpPsj9ZO0PsJG/uLYJun3tTa15SZzmd7zre1Jlv7FJ9AKri6P7xtbYVpoAbMyRM/j65ZiUxWFudPVNk/MyG1l01PC6XJN40Frve+50WNfgZhbKK6RE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P189MB1672.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(23010399003)(366016)(1800799024)(376014)(10067099003)(6133799003)(3023799007)(22082099003)(18002099003)(12006099003)(56012099006)(11063799006)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: wg57bgQjXLz63iYRp5vi+wYUwXRsm/TmWIf5jxzXW6sW7KOhrm0W1hbBKLdbzWkxuivcJQyOb3WEJemE4MHmvYM+JI58fI3CCDuIOiYGvqDqUaAy/8yiojOhqLUXbWbbCyL6fXyhr3we9yAeUeqxmfkQiZWBBZchux2hxDqjQsC+VhM7rx9GcclnZncsObC0ERCXNQalqmZsmzwuILrE/+CuqhadnLd/Jqrr1SmsUtJZrO6sZOhM4PiC2YQt+ZN2ufYroEJ6S1oV7rHz9rOhhLsEZAKGypLmzkiBjX0c1iJj87Ji6L99fNGFujfQWRSv+JGl3VNiETGK0+5E5j9ablB++MT9/VasGzu9qBcfrnagHIDVQCt5V6Tmq7+OYKvTLv1McRHZwMiJIhyj6CSr+5Sy2q/B7uAukO87808WE3t947iuI0AeAZAztbjuGppLrKqFSiTfCjPf6CG0t2svRppBZmscy0mHzhReRXah0WIr/P5ozM1ZTswAWOiR0Q1J97aUe8Od6mQ+VaJzaK/7oNgZxv7djZHMfq5hoLNLrevf3Q3ayVm9gcTjPTUgRM9hEOL2sjD2CQHmJac+wxEgOI+UxhxkqMQVJsnGCv85keFvMWHpKJiZqr9XbtmIGZQL7gCV/qT0Q4DrdCi2jgj7ctNAxUfZGFX/W1xtVsTW+BsSTXDKxnqukyWyVKTnQG+KpxCqFGm5OA6eQujxWEhD7zBN8y4GLc0csk1RZRH4ix+jf8HAQR0omRJgGf6vG+Q7sRAgKlqdU2yLTZmQilrLiIwBXogB1hitDGeCEddsjRov8OjPvn/pPuBNCf66VLij01gxcGreKodJyIH3NWvf2w0G2BPBMYCwUbEK3ysNdmyZ+9zA9elLu74MMJ65BJfBVR9MtTjIs6fEY1Ld42jU7Rhe/nCa8ZPtD3307gxtNL3KYFxdeuVAd+n3LWP23M1A/ryKOwRp0u1evLkk4/WwX/wLX7MG0UZ+yPa3vZ2Dkc9iUcKSehhg+HyLsnkr/YigxC04LYlesFs551KKRrzmFkRM+au/l/uEO4nyQ80BNKHJVZ8uw1DftXua8tfqyS3XuH3HUDcrwWOywrm8qeAi9k/mur+Fi/Nq+r0dybt7Bi6cQ5NMxyvXEd+6HKf1oQXjgWayN3jRWXaggcta4PCplqafX4r6D2gPFwc96YgxFW86lh8OxVKJWTq81F1sDr+MFHJXOnjufx6dOJ4cFmFZmfyi6DY5vkJ6knPuwCb6hLlGuPurCgcuzGLT+3V+RWEdIH3sATicWEAo0cOAxN/nN7prnZYy1kVL22y8lUkDedVWBxV7jST1/N92vRX2MOCvTKi+9qfXqIepH92MHWCcQUUe78wY2r1Pu1Gy0UbhiujHWlUC1gqTle8R7pmrAinBRtu1WXDLay9X4xlAgHIUCC5v4M1UQYxLQvtCBtfU0/LndcdmcSXvCoHVALdKQ374s0Ih+fe1eoZHoV8wr4C+dZoAY25wTPJ9qNJyj88KReHGnuZiiDFX3/m8zq/c58xrZg7XYF4N/x/DDyLSZaFuFkgWXMxlqq3Y3uQCtsAmPjXLZitIdgarK+HznMG9NpsNKM5HuT9MlqNjsISS4YxPAEK/XzvULNYhxdqbOwOekNcYCWaQ41j3F7jEl2xzZ56uBuMCEy0RQaowPT2a3CxlRA7//usAjGSQPRfvZex14k7GSCr6zNjevk+f5sv+PmHTQaiGajngEseF9FIODWPGZQmCj2h1yzSMpRRlIifGZ0d/C3cldzZzqS/ohCxrXXFP8kYyGVmt X-MS-Exchange-AntiSpam-MessageData-1: uLNkplR2YIBXzDQytfVLTu/YDpmdFv5Nt8+rpzeP1MyuRXyy2r47KwDw X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: c667ccea-a6e2-43e7-2827-08df0cb39694 X-MS-Exchange-CrossTenant-AuthSource: AS8P189MB1672.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 07:42:37.6198 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: qCPAiJMtFtTaXHLhrqM+L40a6YA1Ru7kEZ31jGfvDKikgccGoEUoNW6UdhZEwkdWCMaU1SObSsEX8Xo6Yc3URhAgK7TVqbsixwHoFUfEPH0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3558 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 07 Sep 2026 07:48:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129804 Backport patch to fix CVE-2026-45112. References: https://nvd.nist.gov/vuln/detail/CVE-2026-45112 Upstream fix: https://github.com/apache/thrift/commit/16b3673827498d1f4b05f8026d5d580b8e8f5aa2 Signed-off-by: Adarsh Jagadish Kamini --- .../thrift/thrift/CVE-2026-45112.patch | 306 ++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 307 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-45112.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-45112.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-45112.patch new file mode 100644 index 0000000000..7e4fb78911 --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-45112.patch @@ -0,0 +1,306 @@ +From 4d68f215f05905a19dd43865fb97d170b4fc1a3b Mon Sep 17 00:00:00 2001 +From: Jens Geyer +Date: Fri, 8 May 2026 21:24:30 +0200 +Subject: [PATCH] Add message byte tracking to consumeBuffer() in Java + transports Client: java + +- consumeBuffer() in TMemoryInputTransport and AutoExpandingBufferReadTransport + now decrements remainingMessageSize inline so fast-path buffer reads are + counted toward the per-message size limit +- AutoExpandingBufferReadTransport.fill() resets remainingMessageSize at the + start of each frame, matching TMemoryInputTransport.reset() behavior in + TFramedTransport +- TBinaryProtocol.readString() now checks stringLengthLimit before the + fast-path branch +- Add TestMessageSizeLimits covering all fixed code paths + +Co-Authored-By: Claude Sonnet 4.6 + +CVE: CVE-2026-45112 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/16b3673827498d1f4b05f8026d5d580b8e8f5aa2] + +Signed-off-by: Adarsh Jagadish Kamini +--- + .../thrift/protocol/TBinaryProtocol.java | 6 +- + .../AutoExpandingBufferReadTransport.java | 6 + + .../transport/TMemoryInputTransport.java | 7 +- + .../protocol/TestMessageSizeLimits.java | 196 ++++++++++++++++++ + 4 files changed, 213 insertions(+), 2 deletions(-) + create mode 100644 lib/java/src/test/java/org/apache/thrift/protocol/TestMessageSizeLimits.java + +diff --git a/lib/java/src/main/java/org/apache/thrift/protocol/TBinaryProtocol.java b/lib/java/src/main/java/org/apache/thrift/protocol/TBinaryProtocol.java +index 99c3e9302..49e82ee8a 100644 +--- a/lib/java/src/main/java/org/apache/thrift/protocol/TBinaryProtocol.java ++++ b/lib/java/src/main/java/org/apache/thrift/protocol/TBinaryProtocol.java +@@ -458,6 +458,8 @@ public class TBinaryProtocol extends TProtocol { + public String readString() throws TException { + int size = readI32(); + ++ checkStringReadLength(size); ++ + if (trans_.getBytesRemainingInBuffer() >= size) { + String s = + new String(trans_.getBuffer(), trans_.getBufferPosition(), size, StandardCharsets.UTF_8); +@@ -465,7 +467,9 @@ public class TBinaryProtocol extends TProtocol { + return s; + } + +- return readStringBody(size); ++ byte[] buf = new byte[size]; ++ trans_.readAll(buf, 0, size); ++ return new String(buf, StandardCharsets.UTF_8); + } + + public String readStringBody(int size) throws TException { +diff --git a/lib/java/src/main/java/org/apache/thrift/transport/AutoExpandingBufferReadTransport.java b/lib/java/src/main/java/org/apache/thrift/transport/AutoExpandingBufferReadTransport.java +index d59c657db..53b35c207 100644 +--- a/lib/java/src/main/java/org/apache/thrift/transport/AutoExpandingBufferReadTransport.java ++++ b/lib/java/src/main/java/org/apache/thrift/transport/AutoExpandingBufferReadTransport.java +@@ -39,6 +39,7 @@ public class AutoExpandingBufferReadTransport extends TEndpointTransport { + inTrans.readAll(buf.array(), 0, length); + pos = 0; + limit = length; ++ resetConsumedMessageSize(-1); + } + + @Override +@@ -70,6 +71,11 @@ public class AutoExpandingBufferReadTransport extends TEndpointTransport { + @Override + public final void consumeBuffer(int len) { + pos += len; ++ if (remainingMessageSize >= len) { ++ remainingMessageSize -= len; ++ } else { ++ remainingMessageSize = 0; ++ } + } + + @Override +diff --git a/lib/java/src/main/java/org/apache/thrift/transport/TMemoryInputTransport.java b/lib/java/src/main/java/org/apache/thrift/transport/TMemoryInputTransport.java +index 375e2b72a..2fff0dacc 100644 +--- a/lib/java/src/main/java/org/apache/thrift/transport/TMemoryInputTransport.java ++++ b/lib/java/src/main/java/org/apache/thrift/transport/TMemoryInputTransport.java +@@ -96,7 +96,6 @@ public final class TMemoryInputTransport extends TEndpointTransport { + if (amtToRead > 0) { + System.arraycopy(buf_, pos_, buf, off, amtToRead); + consumeBuffer(amtToRead); +- countConsumedMessageBytes(amtToRead); + } + return amtToRead; + } +@@ -119,7 +118,13 @@ public final class TMemoryInputTransport extends TEndpointTransport { + return endPos_ - pos_; + } + ++ @Override + public void consumeBuffer(int len) { + pos_ += len; ++ if (remainingMessageSize >= len) { ++ remainingMessageSize -= len; ++ } else { ++ remainingMessageSize = 0; ++ } + } + } +diff --git a/lib/java/src/test/java/org/apache/thrift/protocol/TestMessageSizeLimits.java b/lib/java/src/test/java/org/apache/thrift/protocol/TestMessageSizeLimits.java +new file mode 100644 +index 000000000..ab12a0f70 +--- /dev/null ++++ b/lib/java/src/test/java/org/apache/thrift/protocol/TestMessageSizeLimits.java +@@ -0,0 +1,196 @@ ++/* ++ * Licensed to the Apache Software Foundation (ASF) under one ++ * or more contributor license agreements. See the NOTICE file ++ * distributed with this work for additional information ++ * regarding copyright ownership. The ASF licenses this file ++ * to you under the Apache License, Version 2.0 (the ++ * "License"); you may not use this file except in compliance ++ * with the License. You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, ++ * software distributed under the License is distributed on an ++ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ++ * KIND, either express or implied. See the License for the ++ * specific language governing permissions and limitations ++ * under the License. ++ */ ++package org.apache.thrift.protocol; ++ ++import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; ++import static org.junit.jupiter.api.Assertions.assertThrows; ++ ++import java.util.Arrays; ++import org.apache.thrift.TConfiguration; ++import org.apache.thrift.transport.AutoExpandingBufferReadTransport; ++import org.apache.thrift.transport.TMemoryInputTransport; ++import org.apache.thrift.transport.TTransportException; ++import org.junit.jupiter.api.Test; ++ ++/** ++ * Tests that message size limits are enforced in the fast-path buffer reads of ++ * TBinaryProtocol/TCompactProtocol and that consumeBuffer() correctly tracks consumed bytes. ++ */ ++public class TestMessageSizeLimits { ++ ++ /** Build TBinaryProtocol-encoded bytes for a string: 4-byte big-endian length + raw bytes. */ ++ private byte[] encodeBinaryString(String s) { ++ byte[] data = s.getBytes(java.nio.charset.StandardCharsets.UTF_8); ++ byte[] out = new byte[4 + data.length]; ++ int len = data.length; ++ out[0] = (byte) (len >> 24); ++ out[1] = (byte) (len >> 16); ++ out[2] = (byte) (len >> 8); ++ out[3] = (byte) len; ++ System.arraycopy(data, 0, out, 4, data.length); ++ return out; ++ } ++ ++ /** ++ * Build TCompactProtocol-encoded bytes for a string: varint length + raw bytes. Assumes length < ++ * 128 so it fits in one varint byte. ++ */ ++ private byte[] encodeCompactString(String s) { ++ byte[] data = s.getBytes(java.nio.charset.StandardCharsets.UTF_8); ++ assert data.length < 128 : "test helper only handles single-byte varints"; ++ byte[] out = new byte[1 + data.length]; ++ out[0] = (byte) data.length; ++ System.arraycopy(data, 0, out, 1, data.length); ++ return out; ++ } ++ ++ private static String repeat(char c, int n) { ++ char[] chars = new char[n]; ++ Arrays.fill(chars, c); ++ return new String(chars); ++ } ++ ++ @Test ++ public void testBinaryProtocol_stringLengthLimitEnforcedInFastPath() throws Exception { ++ // 100-char string encoded for TBinaryProtocol - all bytes in transport so fast path fires ++ byte[] buf = encodeBinaryString(repeat('A', 100)); ++ TMemoryInputTransport transport = new TMemoryInputTransport(buf); ++ ++ // Protocol limited to 10 bytes per string ++ TBinaryProtocol proto = new TBinaryProtocol(transport, 10L, -1L, false, true); ++ ++ assertThrows( ++ TProtocolException.class, ++ proto::readString, ++ "stringLengthLimit must be enforced even when the fast path is taken"); ++ } ++ ++ @Test ++ public void testBinaryProtocol_stringLengthLimitAllowsValidString() throws Exception { ++ byte[] buf = encodeBinaryString("Hello"); ++ TMemoryInputTransport transport = new TMemoryInputTransport(buf); ++ ++ TBinaryProtocol proto = new TBinaryProtocol(transport, 10L, -1L, false, true); ++ ++ assertDoesNotThrow( ++ proto::readString, "string within stringLengthLimit must be readable via fast path"); ++ } ++ ++ @Test ++ public void testCompactProtocol_stringLengthLimitEnforcedInFastPath() throws Exception { ++ byte[] buf = encodeCompactString(repeat('A', 100)); ++ TMemoryInputTransport transport = new TMemoryInputTransport(buf); ++ ++ TCompactProtocol proto = new TCompactProtocol(transport, 10L, -1L); ++ ++ assertThrows( ++ TProtocolException.class, ++ proto::readString, ++ "TCompactProtocol stringLengthLimit must reject oversized strings in fast path"); ++ } ++ ++ @Test ++ public void testConsumeBuffer_decrementsRemainingMessageSize() throws Exception { ++ // 20-byte transport; updateKnownMessageSize sets remainingMessageSize = 20 ++ byte[] buf = new byte[20]; ++ TMemoryInputTransport transport = new TMemoryInputTransport(buf); ++ ++ transport.consumeBuffer(15); ++ ++ // 5 bytes remain; requesting 5 must succeed ++ assertDoesNotThrow(() -> transport.checkReadBytesAvailable(5)); ++ ++ // requesting 6 must fail ++ assertThrows( ++ TTransportException.class, ++ () -> transport.checkReadBytesAvailable(6), ++ "checkReadBytesAvailable must reflect bytes consumed via consumeBuffer"); ++ } ++ ++ @Test ++ public void testBinaryProtocol_fastPathReadsDrainRemainingMessageSize() throws Exception { ++ // 10 i32 values = 40 bytes; maxMessageSize exactly 40 ++ byte[] buf = new byte[40]; ++ TConfiguration config = TConfiguration.custom().setMaxMessageSize(40).build(); ++ TMemoryInputTransport transport = new TMemoryInputTransport(config, buf); ++ TBinaryProtocol proto = new TBinaryProtocol(transport); ++ ++ // Reading 8 i32 values via fast path consumes 32 bytes ++ for (int i = 0; i < 8; i++) { ++ proto.readI32(); ++ } ++ ++ // 8 bytes remain — requesting exactly 8 must succeed ++ assertDoesNotThrow( ++ () -> transport.checkReadBytesAvailable(8), ++ "8 bytes should still be available after 32 consumed via fast path"); ++ ++ // requesting 9 must fail — size limit is properly tracked ++ assertThrows( ++ TTransportException.class, ++ () -> transport.checkReadBytesAvailable(9), ++ "fast-path reads must decrement remaining message size so limits can be enforced"); ++ } ++ ++ @Test ++ public void testRead_doesNotDoubleCountConsumedBytes() throws Exception { ++ // If read() double-counted, consuming 10 bytes via read() on a 20-byte transport ++ // would wrongly decrement remainingMessageSize by 20 instead of 10. ++ byte[] buf = new byte[20]; ++ TMemoryInputTransport transport = new TMemoryInputTransport(buf); ++ byte[] dest = new byte[10]; ++ transport.read(dest, 0, 10); ++ ++ // 10 bytes remain; requesting 10 must succeed ++ assertDoesNotThrow(() -> transport.checkReadBytesAvailable(10)); ++ ++ // requesting 11 must fail ++ assertThrows( ++ TTransportException.class, ++ () -> transport.checkReadBytesAvailable(11), ++ "read() must not double-count consumed bytes after consumeBuffer fix"); ++ } ++ ++ @Test ++ public void testAutoExpandingBufferReadTransport_fillResetsMessageSizePerFrame() ++ throws Exception { ++ // fill() must reset remainingMessageSize so that consumption across frames on a long-lived ++ // TFastFramedTransport connection does not accumulate toward the per-message limit. ++ TConfiguration config = TConfiguration.custom().setMaxMessageSize(80).build(); ++ AutoExpandingBufferReadTransport readBuf = new AutoExpandingBufferReadTransport(config, 100); ++ TMemoryInputTransport source = new TMemoryInputTransport(new byte[200]); ++ ++ // Frame 1: fill and consume 70 bytes ++ readBuf.fill(source, 70); ++ readBuf.consumeBuffer(70); ++ ++ // Frame 2: fill resets remainingMessageSize to maxMessageSize (80) before new frame ++ readBuf.fill(source, 70); ++ readBuf.consumeBuffer(70); ++ ++ // After two frames of 70 bytes each, 10 bytes of budget must still be available ++ assertDoesNotThrow( ++ () -> readBuf.checkReadBytesAvailable(10), ++ "fill() must reset remainingMessageSize so multi-frame connections stay functional"); ++ assertThrows( ++ TTransportException.class, ++ () -> readBuf.checkReadBytesAvailable(11), ++ "remaining budget after fill-reset and 70-byte consume should be exactly 10"); ++ } ++} diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb index b5dee9bd00..ad4e841d7b 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb @@ -18,6 +18,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://CVE-2026-48144.patch \ file://CVE-2026-58389.patch \ file://CVE-2026-41608.patch \ + file://CVE-2026-45112.patch \ " SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5" From patchwork Mon Sep 7 07:42:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 97451 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F09FEC79F89 for ; Mon, 7 Sep 2026 07:49:00 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.65]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29640.1788766964563572350 for ; Mon, 07 Sep 2026 00:42:47 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=t/CMV1dH; spf=pass (domain: est.tech, ip: 52.101.69.65, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=F48paw3iIm1EkDWzlv9h6cJsYlHomlOqSvDGmBeSTZ6cOcqbrMXz+beUP9Abc2vmxiLNxIPq/yfAxo6LEeOK7bybnbiMwcDKBuVcZTLOZYEeVNooC3y0SdGVHgJfV/bXVzbqcq4pG8uCDkb7dRT3M8n6Otb/HHoGZzMtUImIlFijvIE9paQRKmk7Z0SJcgpewZIMbpRBiYIVUIZCKjzx4UtlRmh5l8vrZ5BnroGrjYOAqAOYMqceZrrOuqNukUSeqxCgaADcv+Wua4d0hMyEj0Rs4tbOVnp0++Nd0CJkg3VdE9B59sri3TdtV3YtqtGaik+F0eviNE0SOV+q5CdeDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Zq1W99mQHTlBo04kEeG5sLwpXGnhd/jtdQqF+dNnnSM=; b=mVX9fg63vH/AmWK0NKH7XdbYChxz/gYrS8Rw8OQtYGzXu1DzHSixxdRNPOgzw32LV+4KjHOORh/HUtrZdbycMDqgi+FfHnxwNpWawMCoRqO581UfxYertyHkdAmqCzm58gxUMQoPzy18SxBlcAbEJE8DE0QJN8c/TS26dP7YnBZ0kru2lCYaY6kWwMbVcvwr9g5KR45RtwQL63G37Otz7crBYhTFvV517A0qAKRc61hRkT3G2X6kqIS8uDzB9mNvS+sJmNTiR3Bfe9FFe90a+cKoDDNcQwYBMun/dqzfKs1jAmXS0eUvJacPtZbboB9M8u357pm8WclxGJN78ftFDA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Zq1W99mQHTlBo04kEeG5sLwpXGnhd/jtdQqF+dNnnSM=; b=t/CMV1dHkSUs/xZFiTouoe9uCiwPF7jbIm/KUxuujpYp5zwbKLT5jL1KzoReGNEN6lnYyr/7qv5+ZKKghDW9wFLdcK3BgSSMIZ60+7o9LKjoynqAohhAhNh9K3OWb7/uhUMsyHrJ/XhiKJkNBmZ/8NXl90cI/lTQ4wdNdlJa+KVlg5BIT0w2gZzt1T8pH0eImCBFZ01u5Zp0SMrCr9e5ECk3iExD2qlYkMShCzRW7d9YEbUui+QDooc+p4HI5ENT9HDYxaXdzTn9Rd1sSjZlF8MiMtGBdfcNhMHH+L0RG1IEADxEDyIw8l80LktfkZ238ZjdjjOldcAEyR6P6PM4TA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) by GV4P189MB3558.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b4::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 07:42:39 +0000 Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff]) by AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 07:42:39 +0000 From: "Adarsh Jagadish Kamini" To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][wrynose][PATCH 3/4] thrift: fix CVE-2026-55969 Date: Mon, 7 Sep 2026 09:42:19 +0200 Message-ID: <20260907074231.388316-3-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260907074231.388316-1-adarsh.jagadish.kamini@est.tech> References: <20260907074231.388316-1-adarsh.jagadish.kamini@est.tech> X-ClientProxiedBy: LO6P123CA0037.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2fe::9) To AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P189MB1672:EE_|GV4P189MB3558:EE_ X-MS-Office365-Filtering-Correlation-Id: e9623256-13b4-426a-c192-08df0cb39792 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|23010399003|366016|1800799024|376014|10067099003|6133799003|3023799007|22082099003|20052099010|18002099003|12006099003|56012099006|11063799006|13003099007; X-Microsoft-Antispam-Message-Info: nCpaa81JZaFkoyrRRh+wKUaVSd+N8EJRBlVxiMUkycW/TMRbAi3CjSD7g9DPTXStLu1Ozg31IuA1udrHs8yzim5H6nOf3irqYIshiedQb1M2b70moD0GrCp5vZI5n3ojbKW6FX3J4YTSGKWfInuCyBQcLXhXf84EhkBiT6L6OUQNW/yPwueTE22oHAlMXZ4+wBy9ih+egE/7NamLmV7dBWSeSgUvKYaVh3RaVi2eCI/+JPd3fZhtAHHeavZtqwZFMgR0gMooMXHwFe2XUN0YhP7CF+lVtPFyX+wYbqpnDBhx3ckIPNf2KMNM+kRs/wR7LswtvhceZiMeG6DAWSctRNHl6aiH2PbekIb6ZNxlaX8+8byvOzUIegs6vkPq+TwBpztH6D2jsh66ejs3y+Mc14IrGfDjmtTGl6tFIQtXRPWXpVAp3ZsgwafOVUuz2aWfwqzCYJYaRanJg1BkB6vJsZ/gV/ywhutF/SCkfSdsJ9Ym2nTKQPLhgMI+kcVYQnuMDWIyngi+eCFjKICt/neRjSvz+nfpACj/nXFVvJJCTXxwUCKAsuZXIQDn2Zmgg97r9SU2zoNq5RPqABAsSeazyxSNK+CENuL6AeyWNKN2d5ReI1uzq/ZiuOHEf95UAFi7/gsU3CBqXXWTpTp7dIMGlviXAklXLgmTJw7wgwjghcc= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P189MB1672.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(23010399003)(366016)(1800799024)(376014)(10067099003)(6133799003)(3023799007)(22082099003)(20052099010)(18002099003)(12006099003)(56012099006)(11063799006)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: wr/60WG4jBIgpcihfGFKyJe38I1pk/RQjMZ7RBJhKTGfKoMehiDjbxTxw6VQrKZBmpunDPap9nnsgTEPtU4hobcQDDgACHtRYf/Kh4D3S7bu5nn+sRFtYSQI2GvPA0UE2trcgweklE6HcjzehEx+VBpuGsrMq0780EJG+WlqWBMcd/ZXF5nsb0W7pOGbXiXjCV2WGwU9j96TnSTJko3Dz+5/MPUiZiTF+DJ9N/xuS1Pl+nW/0/4NXJFceVG09U+TFHMZ/Ninv9cjzo6aJFQDxTZK89x5dNcx38OXi7J9Z/kcTVFnwr264y1VnqrXNT6dLkcMI3pqLP1muJJ4Ri6SusS3b91YMHjF/eHcx2ksxe7VKhJtGwdVz9iTjtm9+fb+hDslHRO0jSxXVStpDVJhqEQ87XlGZ6pWX/Gg2Rxg0H7cjVNEl8NlZw3Kly4DxATyQas6Fo6DPDbhenB6nfRU8YXQwgUlq+cEG6jYdUl5HoOH/zjBi0kM2M9g7LGplBE0vGyzPXi8Sri4JrgpUeyP3ATfF694NOHi9wt89dNva8GTSviQFGUvsWWBGsV5jaCprSNClKddJWvW78Mk9yYt31RClcIZfCRladwFAvhHGLagsKZ9pLKv5G8RP7Jn1livaBVTjAZMHPEEeDRxk/icErADDbyXZo65Ux5Ee7fD/UQgVTFMWeShdXekfx7tJ+yvEeVN0fH2AKnN+kguLxTGPbsUi3i53xpzOozZPEKat5bgf9tqQXl7yLhPWOgPvE0fVUjYOmnkBYcpT1O3XzaGbPJVED+NmiynNq9+OJGRos+e5j7Uy3ISBRKqJhOnqtICIb9BYWk6HEGNSdoZ9Z522l8Wn2cR5VcwqMN6RBaqr/gUoRT31dpaWwyS1QIF9nODQp3BFa4srE01jzcNK+Pkuf6kdR9KlfKvTFdirnpB2eD5Ch4ReS26GDYegGhmUEkiSVyL8uwENDIB9GUBtqM1cu6PUwf6m0OjBy0YJKyRuB2EzpZ573atgcB6zmuJFeZBM54OpgB3FwN7CO04PqG0YpriORS2ARr0Nbjq8dbp0U4y8FYFOM+NOn3oypasjAnatP9ESsNjaBdSrGIJhD21Gf4LDeMl57+mRjdkw+hNAvZ4Qhjf58eXi68F0jMUzk6LPW6MaH3SusjSNXBBaRCKwx/IJXf5HtNF9pbZ08stwe+vpDJ+m4sjVibC1vCJxNvq3q6M/c1FpeOX3RRmJPfhodFidYZv8x28WiYpP/X9mo4K5iN2yVshB649MntCnj07Yk47aY8YkEYlmxretPCFtd3gl3/gZT2QtxrrJtyEtSVpl30YCbQAzJH3DuYbXBUcJwyR/uG6bq8w43H+OEKAWSURp3JrqoNKeyNKhMSkbpk4ZZUnjbRshx9iXS1w1YVKk0tBCca1uc6J9ep/FVO8m1cRntvqDKSHjKNoz3HXGCtCdwnIuQ0dMhETvuROY/l3EMwTZ9mgLtYUzB99PELSZ6I+rZWRxuBKoXyauw1wgBCMvydk3xIN/EtPRrHur65cReBodKrIm2DY43cGK1e24WOzjOybf213bZxV0UY7aWQ8YrkwMKKLeO6LxZxXxtna9lgxdbppKwMx02024CICqNum0pPp4BOE78vk7vQoToxvHwOnDls+YyoLraguopyaonhiRZ6Nw/ujSAW0GZr2E1yqsGzZdc0Mz+E2KMXq53PgRCn/GF+6Ugs0pKNqBvrUNcv12b3WWMIGosOyG4+6NdkVCR1U+gGZdLqyCNHWyvAoGwPL31E/jLS3HJC0JPkKvdIBR2Sm X-MS-Exchange-AntiSpam-MessageData-1: qYXdei9jHcXp2QDdj9keNbCt5qUO7LyMsb+0jXFRyRHCxHOT0QHAbBwK X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: e9623256-13b4-426a-c192-08df0cb39792 X-MS-Exchange-CrossTenant-AuthSource: AS8P189MB1672.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 07:42:39.2703 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: CkFTCgbqXzbKYIkhlXMSEusv/tuvGS6OBZwYv9U/O8c86XxcPRc+RsRIqmCBWcTfl+ulyFt/LU7X8nittnKqUujjmNxQ+juE60qP2QIXfSs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3558 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 07 Sep 2026 07:49:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129807 Backport patch to fix CVE-2026-55969. References: https://nvd.nist.gov/vuln/detail/CVE-2026-55969 Upstream fix: https://github.com/apache/thrift/commit/983c813c9a1a2302d9a3ae23d7368beceaac2d0a Signed-off-by: Adarsh Jagadish Kamini --- .../thrift/thrift/CVE-2026-55969.patch | 295 ++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 296 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55969.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55969.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55969.patch new file mode 100644 index 0000000000..9a3e2af92a --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55969.patch @@ -0,0 +1,295 @@ +From f288d1a7bdd994872d6ac1e7f2d7eb60b5beb1e5 Mon Sep 17 00:00:00 2001 +From: dxbjavid +Date: Tue, 9 Jun 2026 16:35:58 +0530 +Subject: [PATCH] Widen multiplication operands in container size prechecks to + prevent arithmetic overflow on LLP64 platforms Client: cpp,c_glib Patch: + Javid Khan + +This closes #3590 + +Backport note: in thrift_binary_protocol.c the 0.22.0 tree lacks the +container_limit property infrastructure present upstream (unrelated to this +CVE), so only the intended change was applied: widening the sizei/msize +multiplication operands to gint64 in the checkReadBytesAvailable calls. + +Assisted-by: kiro:claude-sonnet-5 + +CVE: CVE-2026-55969 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/983c813c9a1a2302d9a3ae23d7368beceaac2d0a] + +Signed-off-by: Adarsh Jagadish Kamini +--- + .../c_glib/protocol/thrift_binary_protocol.c | 6 +-- + .../c_glib/protocol/thrift_compact_protocol.c | 10 ++-- + .../c_glib/transport/thrift_transport.c | 2 +- + .../c_glib/transport/thrift_transport.h | 2 +- + lib/cpp/src/thrift/protocol/TBinaryProtocol.h | 6 +-- + .../src/thrift/protocol/TCompactProtocol.h | 6 +-- + lib/cpp/src/thrift/protocol/TJSONProtocol.h | 6 +-- + lib/cpp/src/thrift/protocol/TProtocol.h | 6 +-- + lib/cpp/src/thrift/transport/TTransport.h | 3 +- + lib/cpp/test/ThrifttReadCheckTests.cpp | 48 +++++++++++++++++++ + 10 files changed, 72 insertions(+), 23 deletions(-) + +diff --git a/lib/c_glib/src/thrift/c_glib/protocol/thrift_binary_protocol.c b/lib/c_glib/src/thrift/c_glib/protocol/thrift_binary_protocol.c +index 9e80e107c..3bad603c3 100644 +--- a/lib/c_glib/src/thrift/c_glib/protocol/thrift_binary_protocol.c ++++ b/lib/c_glib/src/thrift/c_glib/protocol/thrift_binary_protocol.c +@@ -562,8 +562,8 @@ thrift_binary_protocol_read_map_begin (ThriftProtocol *protocol, + } + + if(!ttc->checkReadBytesAvailable (THRIFT_TRANSPORT(tp->transport), +- sizei * thrift_binary_protocol_get_min_serialized_size(protocol, k, error) + +- sizei * thrift_binary_protocol_get_min_serialized_size(protocol, v, error), ++ (gint64) sizei * thrift_binary_protocol_get_min_serialized_size(protocol, k, error) + ++ (gint64) sizei * thrift_binary_protocol_get_min_serialized_size(protocol, v, error), + error)) + { + return -1; +@@ -619,7 +619,7 @@ thrift_binary_protocol_read_list_begin (ThriftProtocol *protocol, + } + + if(!ttc->checkReadBytesAvailable (THRIFT_TRANSPORT(tp->transport), +- (sizei * thrift_binary_protocol_get_min_serialized_size(protocol, e, error)), ++ ((gint64) sizei * thrift_binary_protocol_get_min_serialized_size(protocol, e, error)), + error)) + { + return -1; +diff --git a/lib/c_glib/src/thrift/c_glib/protocol/thrift_compact_protocol.c b/lib/c_glib/src/thrift/c_glib/protocol/thrift_compact_protocol.c +index 0aa9a6fe6..f6ad36b36 100644 +--- a/lib/c_glib/src/thrift/c_glib/protocol/thrift_compact_protocol.c ++++ b/lib/c_glib/src/thrift/c_glib/protocol/thrift_compact_protocol.c +@@ -1108,9 +1108,9 @@ thrift_compact_protocol_read_map_begin (ThriftProtocol *protocol, + return -1; + } + +- if(!ttc->checkReadBytesAvailable (THRIFT_TRANSPORT (tp->transport), +- msize * thrift_protocol_get_min_serialized_size (protocol, *key_type, error) + +- msize * thrift_protocol_get_min_serialized_size (protocol, *value_type, error), ++ if(!ttc->checkReadBytesAvailable (THRIFT_TRANSPORT (tp->transport), ++ (gint64) msize * thrift_protocol_get_min_serialized_size (protocol, *key_type, error) + ++ (gint64) msize * thrift_protocol_get_min_serialized_size (protocol, *value_type, error), + error)) + { + return -1; +@@ -1183,8 +1183,8 @@ thrift_compact_protocol_read_list_begin (ThriftProtocol *protocol, + *element_type = ret; + *size = (guint32) lsize; + +- if(!ttc->checkReadBytesAvailable (THRIFT_TRANSPORT (tp->transport), +- (lsize * thrift_protocol_get_min_serialized_size (protocol, *element_type, error)), ++ if(!ttc->checkReadBytesAvailable (THRIFT_TRANSPORT (tp->transport), ++ ((gint64) lsize * thrift_protocol_get_min_serialized_size (protocol, *element_type, error)), + error)) + { + return -1; +diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_transport.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_transport.c +index 9d3f25e75..7e18f712a 100644 +--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_transport.c ++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_transport.c +@@ -160,7 +160,7 @@ thrift_transport_updateKnownMessageSize(ThriftTransport *transport, glong size, + } + + gboolean +-thrift_transport_checkReadBytesAvailable(ThriftTransport *transport, glong numBytes, GError **error) ++thrift_transport_checkReadBytesAvailable(ThriftTransport *transport, gint64 numBytes, GError **error) + { + gboolean boolean = TRUE; + ThriftTransport *tt = THRIFT_TRANSPORT (transport); +diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_transport.h b/lib/c_glib/src/thrift/c_glib/transport/thrift_transport.h +index 83fb5da19..01365ba7f 100644 +--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_transport.h ++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_transport.h +@@ -83,7 +83,7 @@ struct _ThriftTransportClass + gint32 (*read_all) (ThriftTransport *transport, gpointer buf, + guint32 len, GError **error); + gboolean (*updateKnownMessageSize) (ThriftTransport *transport, glong size, GError **error); +- gboolean (*checkReadBytesAvailable) (ThriftTransport *transport, glong numBytes, GError **error); ++ gboolean (*checkReadBytesAvailable) (ThriftTransport *transport, gint64 numBytes, GError **error); + gboolean (*resetConsumedMessageSize) (ThriftTransport *transport, glong newSize, GError **error); + gboolean (*countConsumedMessageBytes) (ThriftTransport *transport, glong numBytes, GError **error); + }; +diff --git a/lib/cpp/src/thrift/protocol/TBinaryProtocol.h b/lib/cpp/src/thrift/protocol/TBinaryProtocol.h +index cba6e6948..1a7410c86 100644 +--- a/lib/cpp/src/thrift/protocol/TBinaryProtocol.h ++++ b/lib/cpp/src/thrift/protocol/TBinaryProtocol.h +@@ -174,18 +174,18 @@ public: + + void checkReadBytesAvailable(TSet& set) override + { +- trans_->checkReadBytesAvailable(set.size_ * getMinSerializedSize(set.elemType_)); ++ trans_->checkReadBytesAvailable(static_cast(set.size_) * getMinSerializedSize(set.elemType_)); + } + + void checkReadBytesAvailable(TList& list) override + { +- trans_->checkReadBytesAvailable(list.size_ * getMinSerializedSize(list.elemType_)); ++ trans_->checkReadBytesAvailable(static_cast(list.size_) * getMinSerializedSize(list.elemType_)); + } + + void checkReadBytesAvailable(TMap& map) override + { + int elmSize = getMinSerializedSize(map.keyType_) + getMinSerializedSize(map.valueType_); +- trans_->checkReadBytesAvailable(map.size_ * elmSize); ++ trans_->checkReadBytesAvailable(static_cast(map.size_) * elmSize); + } + + protected: +diff --git a/lib/cpp/src/thrift/protocol/TCompactProtocol.h b/lib/cpp/src/thrift/protocol/TCompactProtocol.h +index c7d81eea6..97ca460a7 100644 +--- a/lib/cpp/src/thrift/protocol/TCompactProtocol.h ++++ b/lib/cpp/src/thrift/protocol/TCompactProtocol.h +@@ -146,18 +146,18 @@ public: + + void checkReadBytesAvailable(TSet& set) override + { +- trans_->checkReadBytesAvailable(set.size_ * getMinSerializedSize(set.elemType_)); ++ trans_->checkReadBytesAvailable(static_cast(set.size_) * getMinSerializedSize(set.elemType_)); + } + + void checkReadBytesAvailable(TList& list) override + { +- trans_->checkReadBytesAvailable(list.size_ * getMinSerializedSize(list.elemType_)); ++ trans_->checkReadBytesAvailable(static_cast(list.size_) * getMinSerializedSize(list.elemType_)); + } + + void checkReadBytesAvailable(TMap& map) override + { + int elmSize = getMinSerializedSize(map.keyType_) + getMinSerializedSize(map.valueType_); +- trans_->checkReadBytesAvailable(map.size_ * elmSize); ++ trans_->checkReadBytesAvailable(static_cast(map.size_) * elmSize); + } + + /** +diff --git a/lib/cpp/src/thrift/protocol/TJSONProtocol.h b/lib/cpp/src/thrift/protocol/TJSONProtocol.h +index 09eb6eab1..265b33922 100644 +--- a/lib/cpp/src/thrift/protocol/TJSONProtocol.h ++++ b/lib/cpp/src/thrift/protocol/TJSONProtocol.h +@@ -253,18 +253,18 @@ public: + + void checkReadBytesAvailable(TSet& set) override + { +- trans_->checkReadBytesAvailable(set.size_ * getMinSerializedSize(set.elemType_)); ++ trans_->checkReadBytesAvailable(static_cast(set.size_) * getMinSerializedSize(set.elemType_)); + } + + void checkReadBytesAvailable(TList& list) override + { +- trans_->checkReadBytesAvailable(list.size_ * getMinSerializedSize(list.elemType_)); ++ trans_->checkReadBytesAvailable(static_cast(list.size_) * getMinSerializedSize(list.elemType_)); + } + + void checkReadBytesAvailable(TMap& map) override + { + int elmSize = getMinSerializedSize(map.keyType_) + getMinSerializedSize(map.valueType_); +- trans_->checkReadBytesAvailable(map.size_ * elmSize); ++ trans_->checkReadBytesAvailable(static_cast(map.size_) * elmSize); + } + + class LookaheadReader { +diff --git a/lib/cpp/src/thrift/protocol/TProtocol.h b/lib/cpp/src/thrift/protocol/TProtocol.h +index 37b0db711..4eedc5e82 100644 +--- a/lib/cpp/src/thrift/protocol/TProtocol.h ++++ b/lib/cpp/src/thrift/protocol/TProtocol.h +@@ -604,18 +604,18 @@ protected: + + virtual void checkReadBytesAvailable(TSet& set) + { +- ptrans_->checkReadBytesAvailable(set.size_ * getMinSerializedSize(set.elemType_)); ++ ptrans_->checkReadBytesAvailable(static_cast(set.size_) * getMinSerializedSize(set.elemType_)); + } + + virtual void checkReadBytesAvailable(TList& list) + { +- ptrans_->checkReadBytesAvailable(list.size_ * getMinSerializedSize(list.elemType_)); ++ ptrans_->checkReadBytesAvailable(static_cast(list.size_) * getMinSerializedSize(list.elemType_)); + } + + virtual void checkReadBytesAvailable(TMap& map) + { + int elmSize = getMinSerializedSize(map.keyType_) + getMinSerializedSize(map.valueType_); +- ptrans_->checkReadBytesAvailable(map.size_ * elmSize); ++ ptrans_->checkReadBytesAvailable(static_cast(map.size_) * elmSize); + } + + std::shared_ptr ptrans_; +diff --git a/lib/cpp/src/thrift/transport/TTransport.h b/lib/cpp/src/thrift/transport/TTransport.h +index 52b3a0a4d..1269593ac 100644 +--- a/lib/cpp/src/thrift/transport/TTransport.h ++++ b/lib/cpp/src/thrift/transport/TTransport.h +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -272,7 +273,7 @@ public: + * + * @param numBytes numBytes bytes of data + */ +- void checkReadBytesAvailable(long int numBytes) ++ void checkReadBytesAvailable(int64_t numBytes) + { + if (remainingMessageSize_ < numBytes) + throw TTransportException(TTransportException::END_OF_FILE, "MaxMessageSize reached"); +diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp +index 963286100..72e798bc1 100644 +--- a/lib/cpp/test/ThrifttReadCheckTests.cpp ++++ b/lib/cpp/test/ThrifttReadCheckTests.cpp +@@ -243,6 +243,54 @@ BOOST_AUTO_TEST_CASE(test_tthriftcompactprotocol_read_check_pass) { + BOOST_CHECK_NO_THROW(protocol->readString(eleven)); + } + ++BOOST_AUTO_TEST_CASE(test_tthriftbinaryprotocol_container_size_overflow) { ++ std::shared_ptr config (new TConfiguration(1024)); ++ std::shared_ptr transport(new TMemoryBuffer(config)); ++ std::shared_ptr protocol(new TBinaryProtocol(transport)); ++ ++ uint32_t val = 0; ++ TType elemType = apache::thrift::protocol::T_STOP; ++ // 0x40000000 elements of min size 4 require 4 GiB; the product wraps to 0 in ++ // 32-bit math and used to slip past the MaxMessageSize check. ++ TList list(T_I32, 0x40000000); ++ protocol->writeListBegin(list.elemType_, list.size_); ++ protocol->writeListEnd(); ++ BOOST_CHECK_THROW(protocol->readListBegin(elemType, val), TTransportException); ++ protocol->readListEnd(); ++} ++ ++BOOST_AUTO_TEST_CASE(test_tthriftcompactprotocol_container_size_overflow) { ++ std::shared_ptr config (new TConfiguration(1024)); ++ std::shared_ptr transport(new TMemoryBuffer(config)); ++ std::shared_ptr protocol(new TCompactProtocol(transport)); ++ ++ uint32_t val = 0; ++ TType elemType = apache::thrift::protocol::T_STOP; ++ // 0x10000000 elements of min size 16 (UUID) require 4 GiB; the product wraps ++ // to 0 in 32-bit math and used to slip past the MaxMessageSize check. ++ TList list(T_UUID, 0x10000000); ++ protocol->writeListBegin(list.elemType_, list.size_); ++ protocol->writeListEnd(); ++ BOOST_CHECK_THROW(protocol->readListBegin(elemType, val), TTransportException); ++ protocol->readListEnd(); ++} ++ ++BOOST_AUTO_TEST_CASE(test_tthriftjsonprotocol_container_size_overflow) { ++ std::shared_ptr config (new TConfiguration(1024)); ++ std::shared_ptr transport(new TMemoryBuffer(config)); ++ std::shared_ptr protocol(new TJSONProtocol(transport)); ++ ++ uint32_t val = 0; ++ TType elemType = apache::thrift::protocol::T_STOP; ++ // 0x10000000 elements of min size 16 (UUID) require 4 GiB; the product wraps ++ // to 0 in 32-bit math and used to slip past the MaxMessageSize check. ++ TList list(T_UUID, 0x10000000); ++ protocol->writeListBegin(list.elemType_, list.size_); ++ protocol->writeListEnd(); ++ BOOST_CHECK_THROW(protocol->readListBegin(elemType, val), TTransportException); ++ protocol->readListEnd(); ++} ++ + BOOST_AUTO_TEST_CASE(test_tthriftjsonprotocol_read_check_exception) { + std::shared_ptr config (new TConfiguration(MAX_MESSAGE_SIZE)); + std::shared_ptr transport(new TMemoryBuffer(config)); diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb index ad4e841d7b..d548288458 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb @@ -19,6 +19,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://CVE-2026-58389.patch \ file://CVE-2026-41608.patch \ file://CVE-2026-45112.patch \ + file://CVE-2026-55969.patch \ " SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5" From patchwork Mon Sep 7 07:42:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 97449 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03FAFC79F89 for ; Mon, 7 Sep 2026 07:48:51 +0000 (UTC) Received: from MRWPR03CU001.outbound.protection.outlook.com (MRWPR03CU001.outbound.protection.outlook.com [40.107.130.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29641.1788766965289206888 for ; Mon, 07 Sep 2026 00:42:45 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=asSbaj6M; spf=pass (domain: est.tech, ip: 40.107.130.48, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=LJJHk8ujk5cB/OvOXB2I6v4DsaWJgfcjKdUoAUB4pnUICBLxbgh7gW4SaFiIJP4feawEMS9qdaLrGdgODvO/R/Ci2lre5BKzeLOx1TA93fR/Q5RQbTcG/FKzjyRlfc8an2pD3b5DsmBZ9wJB9ZM60sEv7CQs3MjyYrCGdfJUBlh7v1OluFJhSyQGwNbnYtKcVW/TO7bM+cG6bO5m4Yg+4sR76kEqexCxpE+OzSDnRO/Z8vc44Rde7jxnJwCLeG7vpJYHk+Hb7wv5WDq9rFKz6ne3rJDv3nwUpOpNhH2SdUb/JnO3oD+FeCFwr6E8CIqs3j0M1taMTlPTSQGLNvsuPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=vgMovgN/+32R2m/filYFqTF2ya3AQPeiYkQpb4xRDuo=; b=SyS7dMjQNPsbr/C7ey7V2g+KtKekQyXz6cEQCOc9Sn9Zk9zh/yxgkl0wrCUNl5Quv43yXo3qlpsxZenZUAL8iaN8rYA6ZNS7wJbensNQdY8gX3QcxQU/4E49rXfJ3jiT/IrdmkO2Y5D1/A8nsMHwVWBkUxtwS6WpqkYerToqzSFna03O/QmeeFBHuRupBRhbr+i2VUiPIkCQdOQySjRh/f/u+z44kddkD8/nr30yqWQyc5mYqwsffGBZhDl/Ix2n2gZx6m8tLF9zejxNVB3PCPULB6vDY0rrd3RpEvGHnRWpM8WnjbBVJjQYFvF47KLobyedhghcJTQ794iUqGRhhw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vgMovgN/+32R2m/filYFqTF2ya3AQPeiYkQpb4xRDuo=; b=asSbaj6Mia7FfctkW1Dh/ho8DLQExFU2GDUXZKbfbLHCfcaDd+1w11BImw8MF79WCrx0joW1LmUkEFQxMnxtWugDM8QQPmZWOwABZ8iyQcVO2bOKwBHZbb7DZsykGuoDSpbdehha5TFmbieTHzlEim6fHBZtr0nwKKzEQCsjh4V2lyju7X4iQkmLKMF9PohjzXwO+mEYc27ebk0uvfiCEsKWcG1WWXk0BEDoP2RuEaN5V5sWBN+vRlDcLNZt8ROjRaaBVvB6ZmHEABBM2/kf14ZwrBxzdnOJcqs+coixpwGCAOPIPQM4Ww/UsR9/VI6JmS8qYrfLBt4WcOVORjalhQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) by PA1P189MB3420.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4fc::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 07:42:41 +0000 Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff]) by AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 07:42:41 +0000 From: "Adarsh Jagadish Kamini" To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][wrynose][PATCH 4/4] thrift: fix CVE-2026-55970 Date: Mon, 7 Sep 2026 09:42:20 +0200 Message-ID: <20260907074231.388316-4-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260907074231.388316-1-adarsh.jagadish.kamini@est.tech> References: <20260907074231.388316-1-adarsh.jagadish.kamini@est.tech> X-ClientProxiedBy: LO6P123CA0033.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2fe::6) To AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P189MB1672:EE_|PA1P189MB3420:EE_ X-MS-Office365-Filtering-Correlation-Id: 658d9fae-9ae3-4e52-295a-08df0cb39899 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|10070799003|13003099007|6133799003|3023799007|10067099003|56012099006|11063799006|22082099003|18002099003|12006099003; X-Microsoft-Antispam-Message-Info: 2gL77WL104iR3777GEGh819179kxZujnuF40eNJK3BrebB4gw2PGKTl9ni4nVLQLSaE8gEvL8eo2hyzxDY7HWx0YulmVVE2oHlgqJHzC0LA2iBFPv/mrZo80A0SXYFs24hC0LJM2Eu6HWE/iy0XwQxgYGwy6VZEIK94cor9CrTrykkloySOVnCTFpMz77V7jjb7lhg4Mb2pVgAap/tK7F69XhSXVGRr2+9TjdmS2v3wbeSbVpD1oyOjCu8Km8AVkNTFFZw6+RtTR2JDBR15pMgkMiw/SvQ/SuHW9ZQZMaAuxjK7/bBF9XsIqHMLfcHOzDJl5A66GTku5y2aLw1Gr1k1vQfRPJdtaz81jplzN3ihga60dQJzcEe13ENNLfVwwp2X62AnCVFTyEHAS2BXWpKvPNhp2GwLgcc1uAqvWV1j4cviiGmqX54XbsfBoe7ksk7IPgI5U+tAhdTJoH1hIqrtXJMSXt0mqeNtGEKaeLJJn5CxS31z48MGwY4JO3VX5jT9hCN/sH7wRvGbnPmIR8WyNL7JxLfDJtblqEdmwgIZ5YXp3cZpFCeidj2n1FFHk1ctW2KXAgZIIwMe0qREaBuvBydbVRjokWCo/UGhRCMXHU1HIc+XKegZ3AdYDYgTF1+8gvPhSJMyCCZMOZIzYiAt1+tNUcHD/z1rOU9stHR0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P189MB1672.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(10070799003)(13003099007)(6133799003)(3023799007)(10067099003)(56012099006)(11063799006)(22082099003)(18002099003)(12006099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: Mq0+c4wwHrJ+EY1C4/MJs49FEQc4WzzwSUAJcqwJTAeNp94W4I+FLUwtiEQpkjerz9CMJUjHHLEghX1+GrmaWUu79nLLWaC2d9jVMak2vU5k1ClHSJFGvlEhsx5cok1pjh7aurUQZU1yt8VWHeyiG7ge9mJJofTQgkfYHo9wBH8b90cQm9p1pKPj/yp3muyuheiK404A/OIJkJyC2mMNQqcopH08bNllcDaAkTbRm+pCrAbHeJjNwOwlC6T6IqKCxax8QfQO8ox4dBoplPaeKygs5J9AMV1C7pkNlSv+xgjEis2/cxDCIaKJKwrQHTpOZYWrpp1vViBS62FS1kbBJAUNJJ6Rr064q7g1nTblmhvSAvI+prmZpPJzU2/QaH5GjUeIPMAdD8RXcwBY44b77vUKjWPtPZHh8vgKn19lQQ9U95Ux+GjGiOnsx/F5Kg4Az8FAIgvgu/dhVK2IgyTfh2nHN5xHDnhdU9VspPds8ItUEUUFBMmvFLLVmFICQuzn5TKCF3JCROvbO9ZdeoB32TE5nf+DXZKF6r/y56F6TauVM1GvFHaV4nMxdEH1mVsvA4wQPExer25Y8y8syVCLzRc2n9bMwBkXH0K0eAhtAgAbAESMgnRwsbRNmdYeTR+KvGzqgw+px1SXcEn6te00WlUpiqdJCZOR8GCI5D8RGHZxNQ7DTuVU+Nv1G7J0Fxt3obE0ziCNY5UQnKk90VssWcsYrWn/4vV6ERbGORk5O6EbZNDEc3XPMGse5TpwUw1rs7QnY/a2Y/Xkrv9hcRoDVV06uNRv7z2WZhAnWipx1Ai6TynGzsFSv5ZStniTgsBo3mqZyXj8prVdZSv8MElgXmKHz9LLfIfWY8AGXwYSd0mZKMQXQ+354bJNtMjgGZU8FFoe2JxZ/tXJGX51ztC85IVIR8VDOaxt12dQBvT18nMOaMGuwfD5ZOciBxn/nEsnzzmsYRfh6cM45Z7N1aK3OBFFbPzhdtHrggWiugYb+s4FQKJRfHPLt+WT3EbXk+rz/ohAcFv5XonlFB6IfCtCY1ENEIAi2hzFXK2Ub3P6xM6XtvG4UxvzxcyglSjhNnOxogeWMMN2mFVvFzazFNEbcGI+G9aaTDGCh3T7koEIdBZXSWtXJVRR3chbDDNZOOFRQjO4dwqWeHzbE4alaxsu3HxjxiEn0p0iTdaFvgZqPmzJhcXOf9x216Z79JDAvnNCCy2MhwMkESVHQiSd4So8YX9mAbNY2U+1XVlLk5gUm76s3COntb4wvjbEbVr0tS84azvKkrG8rkX6ZaJE0D8nZsWx24o+VsnNblddEgLegJHHEHea2zvak7m9a1tOHysMX5cXx8tvLa24qlcBBFhDTL8atAQawVcrWJdXnLZFNvBSXcRTKMFiMJSFGAVBcRQFygPTYiiHq5dbUdvgp2m+MO/5mnbdk4ZqRd5ZYGC+EnhVxaLI42qzSp9h4r4vGyOkC3TyWjvTVOXjk2bbn85q8BKq/NljYFkqTvh230gCgAWarjkoMfsLby7SYKOIcH3K/tpWMaCn/HEPRrPkKVHua+CXhTui4pi9ftV8ExPwbI3nmSdFWWm1AFShTHNFkeD0C+7E7O2Usuy0QkPflgmqjiV0KteDXkUDR/T3AOQjbI4hu9Odu0+M9s7nAZp8+1kH/QcvBi5mUUhcM89W4FYAvt24tFb4PhiaHAw6dAHrZk8SNwdfqYYR4zBiWm/sgsEjytgxeDeJE0HpCIpokGwNqUv6ijtxf0B7HlD8yv/94hlLonVu/wcTBCKoVM7uc8smta5x0pDN X-MS-Exchange-AntiSpam-MessageData-1: oddl/PVyKOjxj4l1UNiC/xu4PsCXjaREak7QCMl6l3sPZx4etnsCSf/F X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 658d9fae-9ae3-4e52-295a-08df0cb39899 X-MS-Exchange-CrossTenant-AuthSource: AS8P189MB1672.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 07:42:41.0321 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 79exvga78LXDnrvB/mWsdVhXexVPqhyyNwWHjM2oDmYmrPN+aEosMjmYI3JAWmnIZQyVrjDoSmdEUqDC7rFb/7a1oTvO1/Dtk9sc36ZW2co= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB3420 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 07 Sep 2026 07:48:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129805 Backport patch to fix CVE-2026-55970. References: https://nvd.nist.gov/vuln/detail/CVE-2026-55970 Upstream fix: https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934 Signed-off-by: Adarsh Jagadish Kamini --- .../thrift/thrift/CVE-2026-55970.patch | 67 +++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch new file mode 100644 index 0000000000..02bcc4cc7c --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch @@ -0,0 +1,67 @@ +From 0fe80cef02c1d3260d3ce278f072ce7e04788c13 Mon Sep 17 00:00:00 2001 +From: dxbjavid +Date: Sat, 13 Jun 2026 17:39:53 +0530 +Subject: [PATCH] fix off-by-ten header bounds check in readHeaderFormat + +Backport note: additive test conflict in ThrifttReadCheckTests.cpp; the 0.22.0 +tree already carries test_theadertransport_zlib_roundtrip from CVE-2026-55971, +so both tests were kept. + +Assisted-by: kiro:claude-sonnet-5 + +CVE: CVE-2026-55970 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934] + +Signed-off-by: Adarsh Jagadish Kamini +--- + .../src/thrift/transport/THeaderTransport.cpp | 5 ++++- + lib/cpp/test/ThrifttReadCheckTests.cpp | 22 +++++++++++++++++++ + 2 files changed, 26 insertions(+), 1 deletion(-) + +diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/src/thrift/transport/THeaderTransport.cpp +index 117c8edd5..0711a547e 100644 +--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp ++++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp +@@ -206,7 +206,10 @@ void THeaderTransport::readHeaderFormat(uint16_t headerSize, uint32_t sz) { + } + headerSize *= 4; + const uint8_t* const headerBoundary = ptr + headerSize; +- if (headerSize > sz) { ++ // ptr already skips the 10-byte common header, so the header section has to ++ // fit in the remaining sz - 10 bytes; comparing against sz alone let the ++ // boundary sit up to 10 bytes past the receive buffer. ++ if (headerSize > sz - 10) { + throw TTransportException(TTransportException::CORRUPTED_DATA, + "Header size is larger than frame"); + } +diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp +index 72e798bc1..4645a9e14 100644 +--- a/lib/cpp/test/ThrifttReadCheckTests.cpp ++++ b/lib/cpp/test/ThrifttReadCheckTests.cpp +@@ -341,4 +341,26 @@ BOOST_AUTO_TEST_CASE(test_theadertransport_zlib_roundtrip) { + BOOST_CHECK(out == payload); + } + ++BOOST_AUTO_TEST_CASE(test_theadertransport_header_size_exceeds_frame) { ++ using apache::thrift::transport::THeaderTransport; ++ // Header-format frame whose declared header size (3 * 4 = 12) leaves fewer ++ // than the 10 common-header bytes inside the 14-byte frame. The trailing ++ // varint bytes are all continuation bytes, so the reader used to run off the ++ // end of the receive buffer. ++ uint8_t frame[] = { ++ 0x00, 0x00, 0x00, 0x0E, // frame length = 14 ++ 0x0F, 0xFF, 0x00, 0x00, // header magic ++ 0x00, 0x00, 0x00, 0x00, // seqId ++ 0x00, 0x03, // header size field (3 -> 12 bytes) ++ 0x02, // protocol id varint ++ 0x00, // num transforms = 0 ++ 0x80, 0x80 // info-header varint, all continuation ++ }; ++ std::shared_ptr buffer(new TMemoryBuffer(frame, sizeof(frame))); ++ std::shared_ptr trans(new THeaderTransport(buffer)); ++ ++ uint8_t out[1]; ++ BOOST_CHECK_THROW(trans->read(out, sizeof(out)), TTransportException); ++} ++ + BOOST_AUTO_TEST_SUITE_END() diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb index d548288458..c926c896d0 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb @@ -20,6 +20,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://CVE-2026-41608.patch \ file://CVE-2026-45112.patch \ file://CVE-2026-55969.patch \ + file://CVE-2026-55970.patch \ " SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"