[meta-oe][wrynose][PATCH 4/4] thrift: fix CVE-2026-58389

From: Adarsh Jagadish Kamini <[email protected]>

Backport patch to fix CVE-2026-58389.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-58389

Upstream fix:
  https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f6657=
6fd0a55

Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
---
 .../thrift/thrift/CVE-2026-58389.patch        | 93 +++++++++++++++++++
 .../thrift/thrift_0.22.0.bb                   |  1 +
 2 files changed, 94 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-583=
89.patch

diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patc=
h b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch
new file mode 100644
index 0000000000..964a20b793
--- /dev/null
+++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch
@@ -0,0 +1,93 @@
+From 44c46c076527db5a4b97c55f09a6f73ab9443cee Mon Sep 17 00:00:00 2001
+From: Javid Khan <[email protected]>
+Date: Mon, 29 Jun 2026 19:51:49 +0530
+Subject: [PATCH] enforce max_string_size on non-strict binary message name
+
+
+CVE: CVE-2026-58389
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/0ab16e3=
a83637711f4e0f788c205f66576fd0a55]
+
+Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
+---
+ lib/rs/src/protocol/binary.rs | 61 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 61 insertions(+)
+
+diff --git a/lib/rs/src/protocol/binary.rs b/lib/rs/src/protocol/binary.rs
+index 596285fb9..38f528571 100644
+--- a/lib/rs/src/protocol/binary.rs
++++ b/lib/rs/src/protocol/binary.rs
+@@ -137,6 +137,17 @@ where
+                 // is the message name. strings (byte arrays) are length-=
prefixed,
+                 // so we've just read the length in the first 4 bytes
+                 let name_size =3D BigEndian::read_i32(&first_bytes) as us=
ize;
++                if let Some(max_size) =3D self.config.max_string_size() {
++                    if name_size > max_size {
++                        return Err(crate::Error::Protocol(ProtocolError::=
new(
++                            ProtocolErrorKind::SizeLimit,
++                            format!(
++                                "Message name size {} exceeds maximum all=
owed size of {}",
++                                name_size, max_size
++                            ),
++                        )));
++                    }
++                }
+                 let mut name_buf: Vec<u8> =3D vec![0; name_size];
+                 self.transport.read_exact(&mut name_buf)?;
+                 let name =3D String::from_utf8(name_buf)?;
+@@ -1227,6 +1238,56 @@ mod tests {
+         }
+     }
+=20
++    #[test]
++    fn must_enforce_string_size_limit_on_non_strict_message_name() {
++        let mem =3D TBufferChannel::with_capacity(100, 100);
++        let (r_mem, mut w_mem) =3D mem.split().unwrap();
++
++        let config =3D TConfiguration::builder()
++            .max_string_size(Some(1000))
++            .build()
++            .unwrap();
++        // non-strict: the first 4 bytes are the (positive) message-name =
length
++        let mut i_prot =3D TBinaryInputProtocol::with_config(r_mem, false=
, config);
++
++        w_mem.set_readable_bytes(&[0x00, 0x00, 0x07, 0xD0]);
++
++        let result =3D i_prot.read_message_begin();
++        assert!(result.is_err());
++        match result {
++            Err(crate::Error::Protocol(e)) =3D> {
++                assert_eq!(e.kind, ProtocolErrorKind::SizeLimit);
++                assert!(e
++                    .message
++                    .contains("Message name size 2000 exceeds maximum all=
owed size of 1000"));
++            }
++            _ =3D> panic!("Expected protocol error with SizeLimit"),
++        }
++    }
++
++    #[test]
++    fn must_allow_non_strict_message_name_at_limit() {
++        let mem =3D TBufferChannel::with_capacity(100, 100);
++        let (r_mem, mut w_mem) =3D mem.split().unwrap();
++
++        let config =3D TConfiguration::builder()
++            .max_string_size(Some(5))
++            .build()
++            .unwrap();
++        // non-strict: the first 4 bytes are the (positive) message-name =
length
++        let mut i_prot =3D TBinaryInputProtocol::with_config(r_mem, false=
, config);
++
++        // name length 5 (=3D=3D limit), name "hello", message type Call,=
 sequence 0
++        w_mem.set_readable_bytes(&[
++            0x00, 0x00, 0x00, 0x05, b'h', b'e', b'l', b'l', b'o', 0x01, 0=
x00, 0x00, 0x00, 0x00,
++        ]);
++
++        let ident =3D i_prot.read_message_begin().unwrap();
++        assert_eq!(ident.name, "hello");
++        assert_eq!(ident.message_type, TMessageType::Call);
++        assert_eq!(ident.sequence_number, 0);
++    }
++
+     #[test]
+     fn must_allow_strings_within_limit() {
+         let mem =3D TBufferChannel::with_capacity(100, 100);
diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe=
/recipes-connectivity/thrift/thrift_0.22.0.bb
index 882e72442a..0128de8519 100644
--- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
+++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
@@ -16,6 +16,7 @@ SRC_URI =3D "https://downloads.apache.org/${BPN}/${PV}/${=
BP}.tar.gz \
            file://CVE-2026-55971.patch \
            file://CVE-2026-58023.patch \
            file://CVE-2026-48144.patch \
+           file://CVE-2026-58389.patch \
            "
 SRC_URI[sha256sum] =3D "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59=
dc64a00df8a1e5"
=20