thrift: fix CVE-2026-55971

Backport patch to fix CVE-2026-55971. References: https://nvd.nist.gov/vuln/detail/CVE-2026-55971 Upstream fix: https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595 Testing: The backported fix ships with a C++ Boost regression test, test_theadertransport_zlib_roundtrip, in lib/cpp/test/ThrifttReadCheckTests.cpp. The recipe builds with -DBUILD_TESTING=OFF, so the C++ test suite is not compiled during a normal build. To verify the fix, the suite was built with BUILD_TESTING=ON (using the native thrift compiler for codegen via THRIFT_COMPILER) and the resulting UnitTests binary was executed against the target sysroot for MACHINE=qemux86-64. Result: test_theadertransport_zlib_roundtrip passed. Full C++ UnitTests suite: 79 of 80 test cases passed, 107659 of 107660 assertions passed. The single failure (ToStringTest/locale_de_DE_floating_point_to_string) is unrelated to this fix and is caused by the de_DE locale not being present in the minimal test sysroot. Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-08-30 00:33:19 +00:00 · 2026-08-03 14:59:19 +02:00
parent b70c726e11
commit 64e5d232e7
2 changed files with 93 additions and 0 deletions
@@ -0,0 +1,92 @@
+From e5f8281298e4809d57143ed52933487fa90f20e0 Mon Sep 17 00:00:00 2001
+From: Jens Geyer <jensg@apache.org>
+Date: Wed, 17 Jun 2026 23:27:46 +0200
+Subject: [PATCH] Read the zlib transform result directly in THeaderTransport
+ untransform Client: cpp
+
+The zlib read path decompressed the frame into the transform buffer and then copied the result back into the receive buffer. Swap the transform buffer in as the receive buffer and read the result directly instead of copying it.
+
+Adds a write/read round-trip test through the zlib transform.
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
+
+Backport notes:
+  - lib/cpp/src/thrift/transport/THeaderTransport.cpp: taken unchanged
+    from upstream.
+  - lib/cpp/test/ThrifttReadCheckTests.cpp: kept only the new
+    test_theadertransport_zlib_roundtrip test. The upstream
+    test_theadertransport_header_size_exceeds_frame test was dropped
+    because it depends on THRIFT-5854, which is not in 0.22.0. Added the
+    #include <thrift/transport/THeaderTransport.h> that the new test
+    needs (added upstream by THRIFT-5854).
+
+Assisted-by: kiro:claude-sonnet-5
+
+CVE: CVE-2026-55971
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ .../src/thrift/transport/THeaderTransport.cpp |  8 ++++++-
+ lib/cpp/test/ThrifttReadCheckTests.cpp        | 24 +++++++++++++++++++
+ 2 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+index b3b833389..117c8edd5 100644
+--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+@@ -298,7 +298,13 @@ void THeaderTransport::untransform(uint8_t* ptr, uint32_t sz) {
+                                     "Error while zlib deflateEnd");
+       }
+ 
+-      memcpy(ptr, tBuf_.get(), sz);
+      // The result now lives in tBuf_ and is typically larger than the source
+      // section it was read from, so it does not fit back into the receive
+      // buffer at ptr.  Swap the transform buffer in as the receive buffer and
+      // continue from its start instead of copying the result back in place.
+      rBuf_.swap(tBuf_);
+      std::swap(rBufSize_, tBufSize_);
+      ptr = rBuf_.get();
+     } else {
+       throw TApplicationException(TApplicationException::MISSING_RESULT, "Unknown transform");
+     }
+diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp
+index 09dffe228..963286100 100644
+--- a/lib/cpp/test/ThrifttReadCheckTests.cpp
+++ b/lib/cpp/test/ThrifttReadCheckTests.cpp
+@@ -31,6 +31,7 @@
+ #include <memory>
+ #include <thrift/transport/TTransportUtils.h>
+ #include <thrift/transport/TBufferTransports.h>
+#include <thrift/transport/THeaderTransport.h>
+ #include <thrift/transport/TSimpleFileTransport.h>
+ #include <thrift/transport/TFileTransport.h>
+ #include <thrift/protocol/TEnum.h>
+@@ -269,4 +270,27 @@ BOOST_AUTO_TEST_CASE(test_tthriftjsonprotocol_read_check_exception) {
+   protocol->readMapEnd();
+ }
+ 
+BOOST_AUTO_TEST_CASE(test_theadertransport_zlib_roundtrip) {
+  using apache::thrift::transport::THeaderTransport;
+  // A run of identical bytes compresses to far fewer bytes than it occupies
+  // once expanded again, so the result of the zlib transform is much larger
+  // than the frame section it is read from.  This drives the full write/read
+  // round trip through the zlib transform path.  Keep the payload small enough
+  // to stay within the transform buffer the reader sizes from its write buffer.
+  const std::size_t N = 700;
+  std::vector<uint8_t> payload(N, 0x42);
+
+  std::shared_ptr<TMemoryBuffer> buffer(new TMemoryBuffer());
+  std::shared_ptr<THeaderTransport> writer(new THeaderTransport(buffer));
+  writer->setTransform(THeaderTransport::ZLIB_TRANSFORM);
+  writer->write(payload.data(), static_cast<uint32_t>(payload.size()));
+  writer->flush();
+
+  std::shared_ptr<THeaderTransport> reader(new THeaderTransport(buffer));
+  std::vector<uint8_t> out(N, 0x00);
+  reader->readAll(out.data(), static_cast<uint32_t>(out.size()));
+
+  BOOST_CHECK(out == payload);
+}
+
+ BOOST_AUTO_TEST_SUITE_END()
@@ -13,6 +13,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
           file://0001-support-reproducible-builds.patch \
           file://CVE-2026-43868.patch \
           file://CVE-2026-43870.patch \
+           file://CVE-2026-55971.patch \
           "
 SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"