thrift: fix CVE-2026-55970

Backport patch to fix CVE-2026-55970.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-55970

Upstream fix:
  https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch

@@ -0,0 +1,67 @@
+From 0fe80cef02c1d3260d3ce278f072ce7e04788c13 Mon Sep 17 00:00:00 2001
+From: dxbjavid <dxbjavid@gmail.com>
+Date: Sat, 13 Jun 2026 17:39:53 +0530
+Subject: [PATCH] fix off-by-ten header bounds check in readHeaderFormat
+
+Backport note: additive test conflict in ThrifttReadCheckTests.cpp; the 0.22.0
+tree already carries test_theadertransport_zlib_roundtrip from CVE-2026-55971,
+so both tests were kept.
+
+Assisted-by: kiro:claude-sonnet-5
+
+CVE: CVE-2026-55970
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ .../src/thrift/transport/THeaderTransport.cpp |  5 ++++-
+ lib/cpp/test/ThrifttReadCheckTests.cpp        | 22 +++++++++++++++++++
+ 2 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+index 117c8edd5..0711a547e 100644
+--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp
++++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+@@ -206,7 +206,10 @@ void THeaderTransport::readHeaderFormat(uint16_t headerSize, uint32_t sz) {
+   }
+   headerSize *= 4;
+   const uint8_t* const headerBoundary = ptr + headerSize;
+-  if (headerSize > sz) {
++  // ptr already skips the 10-byte common header, so the header section has to
++  // fit in the remaining sz - 10 bytes; comparing against sz alone let the
++  // boundary sit up to 10 bytes past the receive buffer.
++  if (headerSize > sz - 10) {
+     throw TTransportException(TTransportException::CORRUPTED_DATA,
+                               "Header size is larger than frame");
+   }
+diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp
+index 72e798bc1..4645a9e14 100644
+--- a/lib/cpp/test/ThrifttReadCheckTests.cpp
++++ b/lib/cpp/test/ThrifttReadCheckTests.cpp
+@@ -341,4 +341,26 @@ BOOST_AUTO_TEST_CASE(test_theadertransport_zlib_roundtrip) {
+   BOOST_CHECK(out == payload);
+ }
+ 
++BOOST_AUTO_TEST_CASE(test_theadertransport_header_size_exceeds_frame) {
++  using apache::thrift::transport::THeaderTransport;
++  // Header-format frame whose declared header size (3 * 4 = 12) leaves fewer
++  // than the 10 common-header bytes inside the 14-byte frame. The trailing
++  // varint bytes are all continuation bytes, so the reader used to run off the
++  // end of the receive buffer.
++  uint8_t frame[] = {
++      0x00, 0x00, 0x00, 0x0E, // frame length = 14
++      0x0F, 0xFF, 0x00, 0x00, // header magic
++      0x00, 0x00, 0x00, 0x00, // seqId
++      0x00, 0x03,             // header size field (3 -> 12 bytes)
++      0x02,                   // protocol id varint
++      0x00,                   // num transforms = 0
++      0x80, 0x80              // info-header varint, all continuation
++  };
++  std::shared_ptr<TMemoryBuffer> buffer(new TMemoryBuffer(frame, sizeof(frame)));
++  std::shared_ptr<THeaderTransport> trans(new THeaderTransport(buffer));
++
++  uint8_t out[1];
++  BOOST_CHECK_THROW(trans->read(out, sizeof(out)), TTransportException);
++}
++
+ BOOST_AUTO_TEST_SUITE_END()

meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb

@@ -21,6 +21,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
            file://CVE-2026-41608.patch \
            file://CVE-2026-45112.patch \
            file://CVE-2026-55969.patch \
+           file://CVE-2026-55970.patch \
            "
 SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"