rabbitmq-c: patch CVE-2026-44236

Details: https://nvd.nist.gov/vuln/detail/cve-2026-44236 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-15 18:27:12 +00:00 · 2026-10-06 09:50:43 +05:30
1 parent a4b45b1d0b
commit 1247184a9d
@@ -0,0 +1,145 @@
+From 17f19124ba26f9c924f9ab53bca975cb8673f862 Mon Sep 17 00:00:00 2001
+From: Kevin Valerio <kvalerio@protonmail.com>
+Date: Tue, 28 Apr 2026 13:45:22 +0200
+Subject: [PATCH] fix(connection): enforce minimum frame_max
+
+(cherry picked from commit 4777d0b5c58cb02966a04a85832436bd66ed5d1f)
+
+CVE: CVE-2026-44236
+Upstream-Status: Backport [https://github.com/alanxz/rabbitmq-c/commit/4777d0b5c58cb02966a04a85832436bd66ed5d1f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ README.md                     |  6 ++++-
+ librabbitmq/amqp_connection.c |  4 +++
+ librabbitmq/amqp_socket.c     |  1 +
+ tests/CMakeLists.txt          |  5 +++-
+ tests/test_tune_connection.c  | 51 +++++++++++++++++++++++++++++++++++
+ 5 files changed, 65 insertions(+), 2 deletions(-)
+ create mode 100644 tests/test_tune_connection.c
+
+diff --git a/README.md b/README.md
+index 7c02d52..2682993 100644
+--- a/README.md
+++ b/README.md
+@@ -133,6 +133,10 @@ terminal window:
+ Please see the `examples` directory for short examples of the use of
+ the `librabbitmq` library.
+ 
+During login, `frame_max` negotiation follows the AMQP minimum frame size.
+Values below `AMQP_FRAME_MIN_SIZE` are raised before the client sizes its
+outbound frame buffer or sends `connection.tune-ok`.
+
+ ### Threading
+ 
+ You cannot share a socket, an `amqp_connection_state_t`, or a channel
+@@ -177,4 +181,4 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+-SOFTWARE.
+\ No newline at end of file
+SOFTWARE.
+diff --git a/librabbitmq/amqp_connection.c b/librabbitmq/amqp_connection.c
+index 4326ef7..f016fc1 100644
+--- a/librabbitmq/amqp_connection.c
+++ b/librabbitmq/amqp_connection.c
+@@ -113,6 +113,10 @@ int amqp_tune_connection(amqp_connection_state_t state, int channel_max,
+ 
+   ENFORCE_STATE(state, CONNECTION_STATE_IDLE);
+ 
+  if (frame_max < AMQP_FRAME_MIN_SIZE) {
+    frame_max = AMQP_FRAME_MIN_SIZE;
+  }
+
+   state->channel_max = channel_max;
+   state->frame_max = frame_max;
+ 
+diff --git a/librabbitmq/amqp_socket.c b/librabbitmq/amqp_socket.c
+index 094ceb7..a7206c7 100644
+--- a/librabbitmq/amqp_socket.c
+++ b/librabbitmq/amqp_socket.c
+@@ -1387,6 +1387,7 @@ static amqp_rpc_reply_t amqp_login_inner(amqp_connection_state_t state,
+   if (res < 0) {
+     goto error_res;
+   }
+  client_frame_max = (uint32_t)amqp_get_frame_max(state);
+ 
+   {
+     amqp_connection_tune_ok_t s;
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index 8c0aee0..624e7f5 100644
+--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
+@@ -23,6 +23,10 @@ add_executable(test_status_enum
+ target_link_libraries(test_status_enum rabbitmq-static)
+ add_test(status_enum test_status_enum)
+ 
+add_executable(test_tune_connection test_tune_connection.c)
+target_link_libraries(test_tune_connection rabbitmq-static)
+add_test(tune_connection test_tune_connection)
+
+ add_executable(test_basic
+                test_basic.c)
+ target_link_libraries(test_basic rabbitmq-static)
+@@ -40,4 +44,3 @@ add_test(sasl_mechanism test_sasl_mechanism)
+ add_executable(test_merge_capabilities test_merge_capabilities.c)
+ target_link_libraries(test_merge_capabilities rabbitmq-static)
+ add_test(merge_capabilities test_merge_capabilities)
+-
+diff --git a/tests/test_tune_connection.c b/tests/test_tune_connection.c
+new file mode 100644
+index 0000000..276e18d
+--- /dev/null
+++ b/tests/test_tune_connection.c
+@@ -0,0 +1,51 @@
+// Copyright 2007 - 2021, Alan Antonuk and the rabbitmq-c contributors.
+// SPDX-License-Identifier: mit
+
+#include "amqp_private.h"
+#include <rabbitmq-c/amqp.h>
+#include <rabbitmq-c/framing.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+
+static void expect_frame_max(int requested, int expected) {
+  int res;
+  amqp_connection_state_t state = amqp_new_connection();
+
+  if (state == NULL) {
+    fprintf(stderr, "amqp_new_connection failed\n");
+    abort();
+  }
+
+  state->state = CONNECTION_STATE_IDLE;
+
+  res = amqp_tune_connection(state, 0, requested, 0);
+  if (res != AMQP_STATUS_OK) {
+    fprintf(stderr, "amqp_tune_connection returned %d\n", res);
+    abort();
+  }
+
+  if (amqp_get_frame_max(state) != expected) {
+    fprintf(stderr, "expected frame_max %d, got %d\n", expected,
+            amqp_get_frame_max(state));
+    abort();
+  }
+
+  if (state->outbound_buffer.len != (size_t)expected) {
+    fprintf(stderr, "expected outbound buffer length %d, got %zu\n", expected,
+            state->outbound_buffer.len);
+    abort();
+  }
+
+  amqp_destroy_connection(state);
+}
+
+int main(void) {
+  expect_frame_max(0, AMQP_FRAME_MIN_SIZE);
+  expect_frame_max(1, AMQP_FRAME_MIN_SIZE);
+  expect_frame_max(AMQP_FRAME_MIN_SIZE - 1, AMQP_FRAME_MIN_SIZE);
+  expect_frame_max(AMQP_FRAME_MIN_SIZE, AMQP_FRAME_MIN_SIZE);
+  expect_frame_max(AMQP_DEFAULT_FRAME_SIZE, AMQP_DEFAULT_FRAME_SIZE);
+
+  return 0;
+}
@@ -4,6 +4,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=7e12f6e40e662e039e2f02b4893011ec"
 LICENSE = "MIT"

 SRC_URI = "git://github.com/alanxz/rabbitmq-c.git;branch=master;protocol=https \
+           file://CVE-2026-44236.patch \
 "
 SRCREV = "84b81cd97a1b5515d3d4b304796680da24c666d8"