mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-26 00:11:04 +00:00
Code Issues Projects Releases Wiki Activity

thrift: fix CVE-2026-55970

Browse Source 
Backport patch to fix CVE-2026-55970.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-55970

Upstream fix:
  https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Adarsh Jagadish Kamini
2026-09-15 07:52:16 +05:30
committed by Anuj Mittal
parent fe4f335ffe
commit 29cdca4152
2 changed files with 68 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch
+67
View File
@@ -0,0 +1,67 @@
From 0fe80cef02c1d3260d3ce278f072ce7e04788c13 Mon Sep 17 00:00:00 2001
From: dxbjavid <dxbjavid@gmail.com>
Date: Sat, 13 Jun 2026 17:39:53 +0530
Subject: [PATCH] fix off-by-ten header bounds check in readHeaderFormat
Backport note: additive test conflict in ThrifttReadCheckTests.cpp; the 0.22.0
tree already carries test_theadertransport_zlib_roundtrip from CVE-2026-55971,
so both tests were kept.
Assisted-by: kiro:claude-sonnet-5
CVE: CVE-2026-55970
Upstream-Status: Backport [https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934]
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
.../src/thrift/transport/THeaderTransport.cpp | 5 ++++-
lib/cpp/test/ThrifttReadCheckTests.cpp | 22 +++++++++++++++++++
2 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
index 117c8edd5..0711a547e 100644
--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
@@ -206,7 +206,10 @@ void THeaderTransport::readHeaderFormat(uint16_t headerSize, uint32_t sz) {
}
headerSize *= 4;
const uint8_t* const headerBoundary = ptr + headerSize;
- if (headerSize > sz) {
+ // ptr already skips the 10-byte common header, so the header section has to
+ // fit in the remaining sz - 10 bytes; comparing against sz alone let the
+ // boundary sit up to 10 bytes past the receive buffer.
+ if (headerSize > sz - 10) {
throw TTransportException(TTransportException::CORRUPTED_DATA,
"Header size is larger than frame");
}
diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp
index 72e798bc1..4645a9e14 100644
--- a/lib/cpp/test/ThrifttReadCheckTests.cpp
+++ b/lib/cpp/test/ThrifttReadCheckTests.cpp
@@ -341,4 +341,26 @@ BOOST_AUTO_TEST_CASE(test_theadertransport_zlib_roundtrip) {
BOOST_CHECK(out == payload);
}
+BOOST_AUTO_TEST_CASE(test_theadertransport_header_size_exceeds_frame) {
+ using apache::thrift::transport::THeaderTransport;
+ // Header-format frame whose declared header size (3 * 4 = 12) leaves fewer
+ // than the 10 common-header bytes inside the 14-byte frame. The trailing
+ // varint bytes are all continuation bytes, so the reader used to run off the
+ // end of the receive buffer.
+ uint8_t frame[] = {
+ 0x00, 0x00, 0x00, 0x0E, // frame length = 14
+ 0x0F, 0xFF, 0x00, 0x00, // header magic
+ 0x00, 0x00, 0x00, 0x00, // seqId
+ 0x00, 0x03, // header size field (3 -> 12 bytes)
+ 0x02, // protocol id varint
+ 0x00, // num transforms = 0
+ 0x80, 0x80 // info-header varint, all continuation
+ };
+ std::shared_ptr<TMemoryBuffer> buffer(new TMemoryBuffer(frame, sizeof(frame)));
+ std::shared_ptr<THeaderTransport> trans(new THeaderTransport(buffer));
+
+ uint8_t out[1];
+ BOOST_CHECK_THROW(trans->read(out, sizeof(out)), TTransportException);
+}
+
BOOST_AUTO_TEST_SUITE_END()
meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
+1
View File
@@ -21,6 +21,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
file://CVE-2026-41608.patch \
file://CVE-2026-45112.patch \
file://CVE-2026-55969.patch \
file://CVE-2026-55970.patch \
"
SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"