rabbitmq-c: patch CVE-2026-44235

Details: https://nvd.nist.gov/vuln/detail/cve-2026-44235 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-11-13 03:37:15 +00:00 · 2026-10-27 13:37:07 +05:30
1 parent f28a144aa0
commit 552db40603
@@ -0,0 +1,85 @@
+From 52f00ef57e55c783c2c436590296d9ff986b65d0 Mon Sep 17 00:00:00 2001
+From: Claude <noreply@anthropic.com>
+Date: Tue, 28 Apr 2026 00:30:47 +0000
+Subject: [PATCH] amqp_connection: reject undersized frames in
+ amqp_handle_input
+
+A malicious AMQP server (or active network attacker on an unencrypted
+connection) can send an AMQP frame whose stated frame body is shorter
+than the per-frame-type header it claims to carry. amqp_handle_input()
+then computed encoded.len as
+
+  state->target_size - HEADER_SIZE - <fixed_header_bytes> - FOOTER_SIZE
+
+with no lower-bound check on target_size. Because encoded.len is a
+size_t, the subtraction wrapped to a value near SIZE_MAX. The bogus
+length was passed to amqp_decode_method() / amqp_decode_properties()
+and through to the table decoder, whose internal bounds checks could
+no longer constrain the parser. The result was an out-of-bounds read
+and process crash on the client side, reachable during amqp_login.
+
+Validate target_size against the minimum required for each frame type
+(METHOD: HEADER_SIZE+4+FOOTER_SIZE, HEADER: HEADER_SIZE+12+FOOTER_SIZE,
+BODY: HEADER_SIZE+FOOTER_SIZE) and return AMQP_STATUS_BAD_AMQP_DATA
+when the frame is too small, before computing encoded.len.
+
+Add the verified PoC bytes as a regression seed for the existing
+fuzz_server harness.
+
+Refs: GHSA-9mmv-r8g3-qp46
+(cherry picked from commit 1d3afbb056fee5cc9ea05680bf32288715d0d802)
+
+CVE: CVE-2026-44235
+Upstream-Status: Backport [https://github.com/alanxz/rabbitmq-c/commit/1d3afbb056fee5cc9ea05680bf32288715d0d802]
+
+Dropped fuzz input for the regression test during backport.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ librabbitmq/amqp_connection.c                 |  19 ++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/librabbitmq/amqp_connection.c b/librabbitmq/amqp_connection.c
+index 56ab8a8..4326ef7 100644
+--- a/librabbitmq/amqp_connection.c
+++ b/librabbitmq/amqp_connection.c
+@@ -320,6 +320,13 @@ int amqp_handle_input(amqp_connection_state_t state, amqp_bytes_t received_data,
+ 
+       switch (decoded_frame->frame_type) {
+         case AMQP_FRAME_METHOD:
+          /* A METHOD frame body must contain at least the 4-byte method id.
+           * Reject undersized frames before subtracting from target_size to
+           * avoid an unsigned underflow that would yield a huge encoded.len
+           * and cause out-of-bounds reads in amqp_decode_method(). */
+          if (state->target_size < HEADER_SIZE + 4 + FOOTER_SIZE) {
+            return AMQP_STATUS_BAD_AMQP_DATA;
+          }
+           decoded_frame->payload.method.id =
+               amqp_d32(amqp_offset(raw_frame, HEADER_SIZE));
+           encoded.bytes = amqp_offset(raw_frame, HEADER_SIZE + 4);
+@@ -335,6 +342,15 @@ int amqp_handle_input(amqp_connection_state_t state, amqp_bytes_t received_data,
+           break;
+ 
+         case AMQP_FRAME_HEADER:
+          /* A HEADER frame body must contain at least 12 bytes (class_id,
+           * weight, body_size). Reject undersized frames before subtracting
+           * from target_size to avoid an unsigned underflow that would yield
+           * a huge encoded.len and cause out-of-bounds reads in
+           * amqp_decode_properties() / the table decoder
+           * (CVE: GHSA-9mmv-r8g3-qp46). */
+          if (state->target_size < HEADER_SIZE + 12 + FOOTER_SIZE) {
+            return AMQP_STATUS_BAD_AMQP_DATA;
+          }
+           decoded_frame->payload.properties.class_id =
+               amqp_d16(amqp_offset(raw_frame, HEADER_SIZE));
+           /* unused 2-byte weight field goes here */
+@@ -354,6 +370,9 @@ int amqp_handle_input(amqp_connection_state_t state, amqp_bytes_t received_data,
+           break;
+ 
+         case AMQP_FRAME_BODY:
+          if (state->target_size < HEADER_SIZE + FOOTER_SIZE) {
+            return AMQP_STATUS_BAD_AMQP_DATA;
+          }
+           decoded_frame->payload.body_fragment.len =
+               state->target_size - HEADER_SIZE - FOOTER_SIZE;
+           decoded_frame->payload.body_fragment.bytes =
@@ -5,6 +5,7 @@ LICENSE = "MIT"

 SRC_URI = "git://github.com/alanxz/rabbitmq-c.git;branch=master;protocol=https \
           file://CVE-2026-44236.patch \
+           file://CVE-2026-44235.patch \
 "
 SRCREV = "84b81cd97a1b5515d3d4b304796680da24c666d8"