python3-autobahn: Upgrade 26.6.1 -> 26.7.1

Upgrade to release 26.7.1: - Fix WebSocket maxMessagePayloadSize being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery - for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past maxMessagePayloadSize is now rejected where it previously passed; uncompressed traffic and the per-frame maxFramePayloadSize wire guard are unaffected - Fix the permessage-deflate max_message_size receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded decompress(..., max_length) left the remaining input in unconsumed_tail undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises PayloadExceededError as soon as the uncompressed size would exceed the cap - Make bounded decompression backend-agnostic: decompress_message_data() gains an optional max_output_len argument (documented on the PerMessageCompress base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by maxFramePayloadSize) and then reject - a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining maxMessagePayloadSize budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check remains as a backstop. Previously only deflate had any decompressed-output cap, so a snappy/bzip2/brotli frame could inflate fully into memory first - Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio WampRawSocketFactory now exposes setProtocolOptions(maxMessagePayloadSize=...) / resetProtocolOptions() (bounds [512, 2**24], default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead max_size=None branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket max_message_size had no effect on the asyncio path Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-07-22 06:17:15 +00:00 · 2026-07-20 17:34:25 +03:00
parent 259d598876
commit a49b5106a1
2 changed files with 91 additions and 1 deletions
@@ -0,0 +1,88 @@
+From c677aa7a80fd551abb391a8f6abd28dc9f5c43a2 Mon Sep 17 00:00:00 2001
+From: Leon Anavi <leon.anavi@konsulko.com>
+Date: Mon, 20 Jul 2026 15:52:32 +0300
+Subject: [PATCH] Skip -march guessing for external cross toolchains
+
+Don't add -march flag when CC/CROSS_COMPILE names an external cross
+toolchain (Yocto/OpenEmbedded, Buildroot, ...). These already
+inject the correct target. Avoid issues such as an unknown value
+'x86-64-v2' for '-march' when cross compiling for ARM machine.
+
+Upstream-Status: Pending [https://github.com/crossbario/autobahn-python/pull/1934]
+
+Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
+---
+ src/autobahn/nvx/_compile_args.py | 36 ++++++++++++++++++++++++++++---
+ 1 file changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/src/autobahn/nvx/_compile_args.py b/src/autobahn/nvx/_compile_args.py
+index 2a35ab31..173e5fd4 100644
+--- a/src/autobahn/nvx/_compile_args.py
+++ b/src/autobahn/nvx/_compile_args.py
+@@ -81,6 +81,10 @@ CIBUILDWHEEL : str, optional
+ AUDITWHEEL_PLAT : str, optional
+     Set by auditwheel/manylinux builds. Indicates wheel build.
+ 
+CC, CROSS_COMPILE : str, optional
+    If either names a triplet-prefixed compiler (e.g. "aarch64-poky-linux-gcc"),
+    an external cross toolchain is assumed and no -march flag is added.
+
+ Examples
+ --------
+ 
+@@ -212,9 +216,6 @@ def get_compile_args():
+         # But default codegen is already optimized for current arch
+         return ["/O2", "/W3"]
+ 
+-    # GCC/Clang on POSIX (Linux, macOS, *BSD)
+-    machine = _get_target_machine()
+-
+     # Base flags for all POSIX platforms
+     base_args = [
+         "-std=c99",
+@@ -233,6 +234,14 @@ def get_compile_args():
+         # deployments). It is NOT safe for distributed wheels or cross-compilation.
+         return base_args + ["-march=native"]
+ 
+    if _is_external_toolchain():
+        # Cross toolchain (Yocto/OpenEmbedded, Buildroot, ...) already sets its
+        # own -march/-mtune; don't second-guess it (#1930).
+        return base_args
+
+    # GCC/Clang on POSIX (Linux, macOS, *BSD)
+    machine = _get_target_machine()
+
+     # Default for everyone (AUTOBAHN_ARCH_TARGET unset or "safe"): a portable
+     # baseline architecture. Defaulting to "safe" rather than -march=native is
+     # what makes cross-compilation work out of the box - a cross toolchain
+@@ -248,6 +257,27 @@ def get_compile_args():
+     return base_args
+ 
+ 
+def _is_external_toolchain():
+    """
+    True if ``CC`` or ``CROSS_COMPILE`` names a triplet-prefixed compiler (e.g.
+    ``aarch64-poky-linux-gcc``), the convention used by externally managed
+    toolchains such as Yocto/OpenEmbedded and Buildroot.
+
+    Returns
+    -------
+    bool
+        True if an externally managed cross toolchain is detected.
+    """
+    for var in ("CC", "CROSS_COMPILE"):
+        value = os.environ.get(var, "")
+        if not value:
+            continue
+        exe = os.path.basename(value.split()[0])
+        if "-" in exe:
+            return True
+    return False
+
+
+ def _get_target_machine():
+     """
+     Return the *target* machine architecture for the build.
+-- 
+2.43.0
+
@@ -3,7 +3,9 @@ HOMEPAGE = "http://crossbar.io/autobahn"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=49165a577911c4178e915dc26e2802a3"

-SRC_URI[sha256sum] = "66b27e066a8ea265541eb07fd964e3116e2b8f51d797eea8a46b55c07fd81a07"
+SRC_URI += "file://0001-Skip-march-guessing-for-external-cross-toolchains.patch"
+
+SRC_URI[sha256sum] = "c6949a2c6eb95fb1c218837dbda0a59abbbebafb8b11098551c01a7061dfd245"

 CVE_PRODUCT = "autobahn"