[meta-oe][wrynose][PATCH 0/4] thrift: multiple CVE fixes

From: Adarsh Jagadish Kamini <[email protected]>

Backport upstream fixes for four CVEs in thrift 0.22.0:

- CVE-2026-55971: OOB read in the C++ THeaderTransport zlib untransform pat=
h.
- CVE-2026-58023: heap over-read in the c_glib buffered/framed transports.
- CVE-2026-48144: missing peer hostname validation in the c_glib TLS client=
.
- CVE-2026-58389: max_string_size not enforced on non-strict binary message
  names (Rust).

Tested on qemux86-64 by building with BUILD_TESTING=3DON:

- CVE-2026-55971: new test_theadertransport_zlib_roundtrip passed.
- CVE-2026-58023: new ReadAcrossBuffer and ReadAcrossFrames tests passed,
  and fail without the fix.

CVE-2026-48144 ships no test; CVE-2026-58389 is in the Rust library, which
this recipe does not build. Neither was run.

Adarsh Jagadish Kamini (4):
  thrift: fix CVE-2026-55971
  thrift: fix CVE-2026-58023
  thrift: fix CVE-2026-48144
  thrift: fix CVE-2026-58389

 .../thrift/thrift/CVE-2026-48144.patch        |  36 +++
 .../thrift/thrift/CVE-2026-55971.patch        |  92 +++++++
 .../thrift/thrift/CVE-2026-58023.patch        | 231 ++++++++++++++++++
 .../thrift/thrift/CVE-2026-58389.patch        |  93 +++++++
 .../thrift/thrift_0.22.0.bb                   |   4 +
 5 files changed, 456 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-481=
44.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-559=
71.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-580=
23.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-583=
89.patch