mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-25 17:32:06 +00:00
Code Issues Projects Releases Wiki Activity

thrift: fix CVE-2026-55971

Browse Source 
Backport patch to fix CVE-2026-55971.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-55971

Upstream fix:
  https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Adarsh Jagadish Kamini
2026-08-03 16:17:10 +02:00
committed by Anuj Mittal
parent 7e6a93e1ce
commit c83d3fa4c2
2 changed files with 99 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch
+98
View File
@@ -0,0 +1,98 @@
From 46533058efd34461065e029d9f180a349647db5e Mon Sep 17 00:00:00 2001
From: Jens Geyer <jensg@apache.org>
Date: Wed, 17 Jun 2026 23:27:46 +0200
Subject: [PATCH] Read the zlib transform result directly in THeaderTransport
untransform Client: cpp
The zlib read path decompressed the frame into the transform buffer and then copied the result back into the receive buffer. Swap the transform buffer in as the receive buffer and read the result directly instead of copying it.
Adds a write/read round-trip test through the zlib transform.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Conflicts Resolved:
lib/cpp/test/ThrifttReadCheckTests.cpp (1 conflict):
- The stable branch lacks the prerequisite THRIFT-5854 commit, so the
test_theadertransport_header_size_exceeds_frame test and the
THeaderTransport.h include it depends on are not present here. Kept only
the new test_theadertransport_zlib_roundtrip test from this fix and added
the missing #include <thrift/transport/THeaderTransport.h> (present in
upstream's tree via the THRIFT-5854 prerequisite) since it is required by
the new test and is a trivial, self-contained include with no functional
code dependency.
Assisted-by: kiro:claude-sonnet-5
Changes from upstream commit db4a473f3a98:
- lib/cpp/src/thrift/transport/THeaderTransport.cpp: adapted from upstream
- lib/cpp/test/ThrifttReadCheckTests.cpp: adapted from upstream
CVE: CVE-2026-55971
Upstream-Status: Backport [https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595]
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
.../src/thrift/transport/THeaderTransport.cpp | 8 ++++++-
lib/cpp/test/ThrifttReadCheckTests.cpp | 24 +++++++++++++++++++
2 files changed, 31 insertions(+), 1 deletion(-)
diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
index b3b833389..117c8edd5 100644
--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
@@ -298,7 +298,13 @@ void THeaderTransport::untransform(uint8_t* ptr, uint32_t sz) {
"Error while zlib deflateEnd");
}
- memcpy(ptr, tBuf_.get(), sz);
+ // The result now lives in tBuf_ and is typically larger than the source
+ // section it was read from, so it does not fit back into the receive
+ // buffer at ptr. Swap the transform buffer in as the receive buffer and
+ // continue from its start instead of copying the result back in place.
+ rBuf_.swap(tBuf_);
+ std::swap(rBufSize_, tBufSize_);
+ ptr = rBuf_.get();
} else {
throw TApplicationException(TApplicationException::MISSING_RESULT, "Unknown transform");
}
diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp
index eb4ca01b2..2ef6ae0c6 100644
--- a/lib/cpp/test/ThrifttReadCheckTests.cpp
+++ b/lib/cpp/test/ThrifttReadCheckTests.cpp
@@ -38,6 +38,7 @@
#include <thrift/protocol/TList.h>
#include <thrift/protocol/TSet.h>
#include <thrift/protocol/TMap.h>
+#include <thrift/transport/THeaderTransport.h>
BOOST_AUTO_TEST_SUITE(ThriftReadCheckExceptionTest)
@@ -224,4 +225,27 @@ BOOST_AUTO_TEST_CASE(test_tthriftjsonprotocol_read_check_exception) {
protocol->readMapEnd();
}
+BOOST_AUTO_TEST_CASE(test_theadertransport_zlib_roundtrip) {
+ using apache::thrift::transport::THeaderTransport;
+ // A run of identical bytes compresses to far fewer bytes than it occupies
+ // once expanded again, so the result of the zlib transform is much larger
+ // than the frame section it is read from. This drives the full write/read
+ // round trip through the zlib transform path. Keep the payload small enough
+ // to stay within the transform buffer the reader sizes from its write buffer.
+ const std::size_t N = 700;
+ std::vector<uint8_t> payload(N, 0x42);
+
+ std::shared_ptr<TMemoryBuffer> buffer(new TMemoryBuffer());
+ std::shared_ptr<THeaderTransport> writer(new THeaderTransport(buffer));
+ writer->setTransform(THeaderTransport::ZLIB_TRANSFORM);
+ writer->write(payload.data(), static_cast<uint32_t>(payload.size()));
+ writer->flush();
+
+ std::shared_ptr<THeaderTransport> reader(new THeaderTransport(buffer));
+ std::vector<uint8_t> out(N, 0x00);
+ reader->readAll(out.data(), static_cast<uint32_t>(out.size()));
+
+ BOOST_CHECK(out == payload);
+}
+
BOOST_AUTO_TEST_SUITE_END()
meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb
+1
View File
@@ -12,6 +12,7 @@ SRC_URI = "https://archive.apache.org/dist/${BPN}/${PV}/${BP}.tar.gz \
file://0001-DefineInstallationPaths.cmake-Define-libdir-in-terms.patch \
file://0001-thrift-pr2755.patch \
file://0001-THRIFT-5842-Add-missing-cstdint-include-for-int64_t-.patch \
file://CVE-2026-55971.patch \
"
SRC_URI[sha256sum] = "b5d8311a779470e1502c027f428a1db542f5c051c8e1280ccd2163fa935ff2d6"