apitrace: patch CVE-2026-126050

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-126050

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch

@@ -0,0 +1,39 @@
+From a7c7db06b56f22235eeea2da608ef84dd401f3b6 Mon Sep 17 00:00:00 2001
+From: Deus Rex research team <research@deusrex.ai>
+Date: Tue, 10 Nov 2026 13:05:32 +0000
+Subject: [PATCH] trace: Fix heap out-of-bounds write in
+ SnappyFile::flushReadCache().
+
+The Snappy trace reader takes each chunk's compressed length from a
+4-byte field in the file and reads that many bytes into
+m_compressedCache, a heap buffer allocated once with a fixed size of
+snappy::MaxCompressedLength(1 MiB) = 1223370 bytes.  The length is never
+compared with that size, so a .trace file that declares and supplies a
+longer chunk makes the read write past the end of the buffer.
+
+(cherry picked from commit 3890c5a448addfd75ccbe1bd09e3075de6fb3395)
+CVE: CVE-2026-126050.patch
+Upstream-Status: Backport [https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ lib/trace/trace_file_snappy.cpp | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/lib/trace/trace_file_snappy.cpp b/lib/trace/trace_file_snappy.cpp
+index 5b60ec9d..9b0a681d 100644
+--- a/lib/trace/trace_file_snappy.cpp
++++ b/lib/trace/trace_file_snappy.cpp
+@@ -224,6 +224,13 @@ void SnappyFile::flushReadCache(size_t skipLength)
+         return;
+     }
+ 
++    if (compressedLength > snappy::MaxCompressedLength(SNAPPY_CHUNK_SIZE)) {
++        std::cerr << "error: invalid compressed chunk length in trace\n";
++        m_stream.setstate(std::ios_base::failbit);
++        createCache(0);
++        return;
++    }
++
+     m_stream.read((char*)m_compressedCache, compressedLength);
+     if (m_stream.fail()) {
+         std::cerr << "warning: unexpected end of file while reading trace\n";

meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb

@@ -9,6 +9,7 @@ SRCREV = "18cfd388ac47a9e00978b34d6c20341f3e2cdb56"
 SRC_URI = "gitsm://github.com/${BPN}/${BPN}.git;branch=master;protocol=https;tag=${PV} \
            file://0001-zstd-disable-the-x86-64-BMI2-assembly-fast-loops.patch \
            file://0002-wrappers-Do-not-export-_init-and-_fini.patch \
+           file://CVE-2026-126050.patch \
            "
 
 DEPENDS += "zlib libpng python3-native"