[meta-oe][scarthgap][PATCH 1/3] thrift: fix CVE-2026-55971

From: Adarsh Jagadish Kamini <[email protected]>

Backport patch to fix CVE-2026-55971.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-55971

Upstream fix:
  https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5d=
d175595

Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
---
 .../thrift/thrift/CVE-2026-55971.patch        | 98 +++++++++++++++++++
 .../thrift/thrift_0.20.0.bb                   |  1 +
 2 files changed, 99 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-559=
71.patch

diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patc=
h b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch
new file mode 100644
index 0000000000..584352a027
--- /dev/null
+++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch
@@ -0,0 +1,98 @@
+From 46533058efd34461065e029d9f180a349647db5e Mon Sep 17 00:00:00 2001
+From: Jens Geyer <[email protected]>
+Date: Wed, 17 Jun 2026 23:27:46 +0200
+Subject: [PATCH] Read the zlib transform result directly in THeaderTranspo=
rt
+ untransform Client: cpp
+
+The zlib read path decompressed the frame into the transform buffer and th=
en copied the result back into the receive buffer. Swap the transform buffe=
r in as the receive buffer and read the result directly instead of copying =
it.
+
+Adds a write/read round-trip test through the zlib transform.
+
+Co-Authored-By: Claude Opus 4.8 <[email protected]>
+
+Conflicts Resolved:
+
+lib/cpp/test/ThrifttReadCheckTests.cpp (1 conflict):
+- The stable branch lacks the prerequisite THRIFT-5854 commit, so the
+  test_theadertransport_header_size_exceeds_frame test and the
+  THeaderTransport.h include it depends on are not present here. Kept only
+  the new test_theadertransport_zlib_roundtrip test from this fix and adde=
d
+  the missing #include <thrift/transport/THeaderTransport.h> (present in
+  upstream's tree via the THRIFT-5854 prerequisite) since it is required b=
y
+  the new test and is a trivial, self-contained include with no functional
+  code dependency.
+
+Assisted-by: kiro:claude-sonnet-5
+
+Changes from upstream commit db4a473f3a98:
+  - lib/cpp/src/thrift/transport/THeaderTransport.cpp: adapted from upstre=
am
+  - lib/cpp/test/ThrifttReadCheckTests.cpp: adapted from upstream
+
+CVE: CVE-2026-55971
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/db4a473=
f3a984eee27273256fe737be5dd175595]
+
+Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
+---
+ .../src/thrift/transport/THeaderTransport.cpp |  8 ++++++-
+ lib/cpp/test/ThrifttReadCheckTests.cpp        | 24 +++++++++++++++++++
+ 2 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/s=
rc/thrift/transport/THeaderTransport.cpp
+index b3b833389..117c8edd5 100644
+--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp
++++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+@@ -298,7 +298,13 @@ void THeaderTransport::untransform(uint8_t* ptr, uint=
32_t sz) {
+                                     "Error while zlib deflateEnd");
+       }
+=20
+-      memcpy(ptr, tBuf_.get(), sz);
++      // The result now lives in tBuf_ and is typically larger than the s=
ource
++      // section it was read from, so it does not fit back into the recei=
ve
++      // buffer at ptr.  Swap the transform buffer in as the receive buff=
er and
++      // continue from its start instead of copying the result back in pl=
ace.
++      rBuf_.swap(tBuf_);
++      std::swap(rBufSize_, tBufSize_);
++      ptr =3D rBuf_.get();
+     } else {
+       throw TApplicationException(TApplicationException::MISSING_RESULT, =
"Unknown transform");
+     }
+diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/Thriftt=
ReadCheckTests.cpp
+index eb4ca01b2..2ef6ae0c6 100644
+--- a/lib/cpp/test/ThrifttReadCheckTests.cpp
++++ b/lib/cpp/test/ThrifttReadCheckTests.cpp
+@@ -38,6 +38,7 @@
+ #include <thrift/protocol/TList.h>
+ #include <thrift/protocol/TSet.h>
+ #include <thrift/protocol/TMap.h>
++#include <thrift/transport/THeaderTransport.h>
+=20
+ BOOST_AUTO_TEST_SUITE(ThriftReadCheckExceptionTest)
+=20
+@@ -224,4 +225,27 @@ BOOST_AUTO_TEST_CASE(test_tthriftjsonprotocol_read_ch=
eck_exception) {
+   protocol->readMapEnd();
+ }
+=20
++BOOST_AUTO_TEST_CASE(test_theadertransport_zlib_roundtrip) {
++  using apache::thrift::transport::THeaderTransport;
++  // A run of identical bytes compresses to far fewer bytes than it occup=
ies
++  // once expanded again, so the result of the zlib transform is much lar=
ger
++  // than the frame section it is read from.  This drives the full write/=
read
++  // round trip through the zlib transform path.  Keep the payload small =
enough
++  // to stay within the transform buffer the reader sizes from its write =
buffer.
++  const std::size_t N =3D 700;
++  std::vector<uint8_t> payload(N, 0x42);
++
++  std::shared_ptr<TMemoryBuffer> buffer(new TMemoryBuffer());
++  std::shared_ptr<THeaderTransport> writer(new THeaderTransport(buffer));
++  writer->setTransform(THeaderTransport::ZLIB_TRANSFORM);
++  writer->write(payload.data(), static_cast<uint32_t>(payload.size()));
++  writer->flush();
++
++  std::shared_ptr<THeaderTransport> reader(new THeaderTransport(buffer));
++  std::vector<uint8_t> out(N, 0x00);
++  reader->readAll(out.data(), static_cast<uint32_t>(out.size()));
++
++  BOOST_CHECK(out =3D=3D payload);
++}
++
+ BOOST_AUTO_TEST_SUITE_END()
diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb b/meta-oe=
/recipes-connectivity/thrift/thrift_0.20.0.bb
index e4fd07198c..23a6debf9a 100644
--- a/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb
+++ b/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb
@@ -12,6 +12,7 @@ SRC_URI =3D "https://archive.apache.org/dist/${BPN}/${PV}=
/${BP}.tar.gz \
            file://0001-DefineInstallationPaths.cmake-Define-libdir-in-term=
s.patch \
            file://0001-thrift-pr2755.patch \
            file://0001-THRIFT-5842-Add-missing-cstdint-include-for-int64_t=
-.patch \
+           file://CVE-2026-55971.patch \
            "
 SRC_URI[sha256sum] =3D "b5d8311a779470e1502c027f428a1db542f5c051c8e1280ccd=
2163fa935ff2d6"
=20