Fix CVE-2026-69219, CVE-2026-69220-rabbitmq-java-client-AtomGit

已开启

Fix CVE-2026-69219, CVE-2026-69220 #9

wang-qi创建于 9月1日从wang-qi927/rabbitmq-java-client： fix-cves 合入到 src-openeuler/rabbitmq-java-client： openEuler-24.03-LTS-SP3

Fix CVE-2026-69219, CVE-2026-69220 #9

已开启

wang-qi创建于 9月1日

从wang-qi927/rabbitmq-java-client fix-cves合入到src-openeuler/rabbitmq-java-client openEuler-24.03-LTS-SP3

共 3 个文件变更+145-2

Abackport-CVE-2026-69219.patch+33-0

@@ -0,0 +1,33 @@
	1	+Backport of upstream rabbitmq-java-client commit 6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2
	2	+"Validate declared length before allocating byte buffers in ValueReader"
	3	+(fixes CVE-2026-69219, author Arnaud Cogoluegnes 2026-07-06, upstream 5.6.x).
	4	+
	5	+Semantic backport for 3.6.5 (manually recreated):
	6	+- path src/main/java -> src/com (3.6.5 pre-maven layout); pom/test hunks dropped;
	7	+- readBytes: replace Integer.MAX_VALUE gate with in.available() consistency check
	8	+ (MalformedFrameException, already imported in 3.6.5).
	9	+---
	10	+--- a/src/com/rabbitmq/client/impl/ValueReader.java
	11	++++ b/src/com/rabbitmq/client/impl/ValueReader.java
	12	+@@ -83,14 +83,14 @@
	13	+ throws IOException
	14	+ {
	15	+ final long contentLength = unsignedExtend(in.readInt());
	16	+- if(contentLength < Integer.MAX_VALUE) {
	17	+- final byte [] buffer = new byte[(int)contentLength];
	18	+- in.readFully(buffer);
	19	+- return buffer;
	20	+- } else {
	21	+- throw new UnsupportedOperationException
	22	+- ("Very long byte vectors and strings not currently supported");
	23	++ final int available = in.available();
	24	++ if (contentLength > available) {
	25	++ throw new MalformedFrameException
	26	++ ("Claimed length " + contentLength + " exceeds available data (" + available + " bytes)");
	27	+ }
	28	++ final byte [] buffer = new byte[(int)contentLength];
	29	++ in.readFully(buffer);
	30	++ return buffer;
	31	+ }
	32	+
	33	+ /** Convenience method - reads a long string argument

Abackport-CVE-2026-69220.patch+103-0

@@ -0,0 +1,103 @@
	1	+Backport of upstream rabbitmq-java-client commit 09af76fce136f3136931654a0a1d43095c80e2f0
	2	+"Limit nesting depth when reading tables and arrays"
	3	+(fixes CVE-2026-69220, author Arnaud Cogoluegnes 2026-07-06, upstream 5.6.x).
	4	+
	5	+Semantic backport for 3.6.5 (manually recreated, applies after backport-CVE-2026-69219.patch):
	6	+- path src/main/java -> src/com (3.6.5 pre-maven layout); pom/test hunks dropped;
	7	+- depth parameter threaded through readTable/readFieldValue/readArray with
	8	+ MAX_FIELD_VALUE_NESTING_DEPTH=32 guard (MalformedFrameException already imported);
	9	+- raw generic types kept per 3.6.5 style.
	10	+---
	11	+--- a/src/com/rabbitmq/client/impl/ValueReader.java
	12	++++ b/src/com/rabbitmq/client/impl/ValueReader.java
	13	+@@ -37,6 +37,9 @@
	14	+ {
	15	+ private static final long INT_MASK = 0xffffffffL;
	16	+
	17	++ /** Maximum depth of nested tables/arrays a field value can contain. */
	18	++ static final int MAX_FIELD_VALUE_NESTING_DEPTH = 32;
	19	++
	20	+ /**
	21	+ * Protected API - Cast an int to a long without extending the
	22	+ * sign bit of the int out into the high half of the long.
	23	+@@ -135,9 +138,13 @@
	24	+ * Reads a table argument from a given stream. Also
	25	+ * called by {@link ContentHeaderPropertyReader}.
	26	+ */
	27	+- private static Map<String, Object> readTable(DataInputStream in)
	28	++ private static Map<String, Object> readTable(DataInputStream in, int depth)
	29	+ throws IOException
	30	+ {
	31	++ if (depth > MAX_FIELD_VALUE_NESTING_DEPTH) {
	32	++ throw new MalformedFrameException
	33	++ ("Too many levels of nested tables/arrays (max " + MAX_FIELD_VALUE_NESTING_DEPTH + ")");
	34	++ }
	35	+ long tableLength = unsignedExtend(in.readInt());
	36	+ if (tableLength == 0) return Collections.emptyMap();
	37	+
	38	+@@ -146,15 +153,19 @@
	39	+ (new TruncatedInputStream(in, tableLength));
	40	+ while(tableIn.available() > 0) {
	41	+ String name = readShortstr(tableIn);
	42	+- Object value = readFieldValue(tableIn);
	43	++ Object value = readFieldValue(tableIn, depth + 1);
	44	+ if(!table.containsKey(name))
	45	+ table.put(name, value);
	46	+ }
	47	+ return table;
	48	+ }
	49	+
	50	+- private static Object readFieldValue(DataInputStream in)
	51	++ private static Object readFieldValue(DataInputStream in, int depth)
	52	+ throws IOException {
	53	++ if (depth > MAX_FIELD_VALUE_NESTING_DEPTH) {
	54	++ throw new MalformedFrameException
	55	++ ("Too many levels of nested tables/arrays (max " + MAX_FIELD_VALUE_NESTING_DEPTH + ")");
	56	++ }
	57	+ Object value = null;
	58	+ switch(in.readUnsignedByte()) {
	59	+ case 'S':
	60	+@@ -173,10 +184,10 @@
	61	+ value = readTimestamp(in);
	62	+ break;
	63	+ case 'F':
	64	+- value = readTable(in);
	65	++ value = readTable(in, depth);
	66	+ break;
	67	+ case 'A':
	68	+- value = readArray(in);
	69	++ value = readArray(in, depth);
	70	+ break;
	71	+ case 'b':
	72	+ value = in.readByte();
	73	+@@ -210,15 +221,19 @@
	74	+ }
	75	+
	76	+ /** Read a field-array */
	77	+- private static List<Object> readArray(DataInputStream in)
	78	++ private static List<Object> readArray(DataInputStream in, int depth)
	79	+ throws IOException
	80	+ {
	81	++ if (depth > MAX_FIELD_VALUE_NESTING_DEPTH) {
	82	++ throw new MalformedFrameException
	83	++ ("Too many levels of nested tables/arrays (max " + MAX_FIELD_VALUE_NESTING_DEPTH + ")");
	84	++ }
	85	+ long length = unsignedExtend(in.readInt());
	86	+ DataInputStream arrayIn = new DataInputStream
	87	+ (new TruncatedInputStream(in, length));
	88	+ List<Object> array = new ArrayList<Object>();
	89	+ while(arrayIn.available() > 0) {
	90	+- Object value = readFieldValue(arrayIn);
	91	++ Object value = readFieldValue(arrayIn, depth + 1);
	92	+ array.add(value);
	93	+ }
	94	+ return array;
	95	+@@ -228,7 +243,7 @@
	96	+ public final Map<String, Object> readTable()
	97	+ throws IOException
	98	+ {
	99	+- return readTable(this.in);
	100	++ return readTable(this.in, 0);
	101	+ }
	102	+
	103	+ /** Public API - reads an octet. */

Mrabbitmq-java-client.spec+9-2

	@@ -4,11 +4,13 @@
4	%global failjunit no	4	%global failjunit no
5	Name: rabbitmq-java-client	5	Name: rabbitmq-java-client
6	Version: 3.6.5	6	Version: 3.6.5
7	-Release: 3	7	+Release: 4
8	Summary: Java Advanced Message Queue Protocol client library	8	Summary: Java Advanced Message Queue Protocol client library
9	License: ASL 2.0 and GPLv2+ and MPLv1.1	9	License: ASL 2.0 and GPLv2+ and MPLv1.1
10	URL: http://www.rabbitmq.com/java-client.html	10	URL: http://www.rabbitmq.com/java-client.html
11	Source0: http://www.rabbitmq.com/releases/%{name}/v%{version}/%{name}-%{version}.tar.gz	11	Source0: http://www.rabbitmq.com/releases/%{name}/v%{version}/%{name}-%{version}.tar.gz
		12	+Patch1: backport-CVE-2026-69219.patch
		13	+Patch2: backport-CVE-2026-69220.patch
12	BuildArch: noarch	14	BuildArch: noarch
13	BuildRequires: maven-local mvn(commons-cli:commons-cli) mvn(commons-io:commons-io) mvn(junit:junit)	15	BuildRequires: maven-local mvn(commons-cli:commons-cli) mvn(commons-io:commons-io) mvn(junit:junit)
14	BuildRequires: ant ant-junit java-headless python3-devel >= 2.6 python3-simplejson	16	BuildRequires: ant ant-junit java-headless python3-devel >= 2.6 python3-simplejson
	@@ -37,7 +39,9 @@ Summary: Javadoc for %{name}
37	This package contains javadoc for %{name}.	39	This package contains javadoc for %{name}.
38		40
39	%prep	41	%prep
40	-%setup -q	42	+%setup -q -n %{name}-%{version}
		43	+%patch -P1 -p1
		44	+%patch -P2 -p1
41	find . -name "*.bat" -delete	45	find . -name "*.bat" -delete
42	find . -name "*.class" -delete	46	find . -name "*.class" -delete
43	find . -name "*.jar" -print -delete	47	find . -name "*.jar" -print -delete
	@@ -86,6 +90,9 @@ sleep 150
86	%license LICENSE*	90	%license LICENSE*
87		91
88	%changelog	92	%changelog
		93	+* Tue Sep 01 2026 wang-qi927 <wangyiqi1@xfusion.com> - 3.6.5-4
		94	+- Fix CVE-2026-69219, CVE-2026-69220
		95	+
89	* Fri Jul 07 2023 Ge Wang <wang__ge@126.com> - 3.6.5-3	96	* Fri Jul 07 2023 Ge Wang <wang__ge@126.com> - 3.6.5-3
90	- Fix build failure caused by deletion failed in rmbuid stage	97	- Fix build failure caused by deletion failed in rmbuid stage
91		98