[fix](thirdparty) Upgrade Brotli to 1.0.10 for CVE-2026-111497 (#69906)

### What problem does this PR solve?

Issue Number: None

Related PR: None

Doris bundles Brotli 1.0.9, which is affected by
[CVE-2026-111497](https://github.com/google/brotli/releases/tag/v1.0.10).
The upstream decoder can mistake an invalid block switch for
insufficient input, allowing an out-of-bounds write.

Upgrade the bundled dependency to the upstream 1.0.10 security release
and update its archive checksum. Align Arrow 24's internal Brotli
version and SHA256 pin with the overridden archive; changing the Doris
manifest alone causes Arrow's ExternalProject verification to fail.
Apply that metadata patch with a separate marker so previously patched
Arrow source trees also receive it.

The fix requires rebuilding the relevant thirdparty libraries and
relinking BE because the decoder is statically linked.

### Release note

Upgrade bundled Brotli to 1.0.10 to include the upstream fix for
CVE-2026-111497.

### Check List (For Author)

- Test: Manual validation passed:
- Official source archive MD5 and SHA256 verification; the source
contains the upstream block-switch error fix.
  - Bash syntax and `git diff --check`.
  - Existing thirdparty download checksum and fallback tests.
- Actual Brotli/Arrow companion download and extraction; patch
application to previously patched Arrow sources and repeated invocation.
  - Patch dry-run against pristine Arrow 24 metadata.
- Arrow 24's Brotli ExternalProject verification, build, and
static-library installation in an isolated CMake harness. Confirmed the
old SHA256 pin fails with the new archive before the patch, then passes
after it.
- Brotli 1.0.10 build and all 14 available upstream
round-trip/compatibility tests with AddressSanitizer and
UndefinedBehaviorSanitizer.
- Full Doris and Arrow builds were not run locally; CI validation is
requested.
- Behavior changed: Yes. Builds use the patched Brotli decoder and
updated Arrow dependency metadata.
- Does this need documentation: No. This updates a bundled security
dependency.

thirdparty/download-thirdparty.sh

@@ -480,6 +480,12 @@ if [[ " ${TP_ARCHIVES[*]} " =~ " ARROW " ]]; then
             patch -p1 <"${TP_PATCH_DIR}/apache-arrow-24.0.0-lzo.patch"
             touch "${PATCHED_MARK}"
         fi
+        # Arrow also verifies the overridden Brotli archive against its own SHA256.
+        # A separate marker updates sources that already have the other Arrow patches.
+        if [[ ! -f "${PATCHED_MARK}_brotli_1_0_10" ]]; then
+            patch -p1 <"${TP_PATCH_DIR}/apache-arrow-24.0.0-brotli-1.0.10.patch"
+            touch "${PATCHED_MARK}_brotli_1_0_10"
+        fi
         cd -
     fi
     echo "Finished patching ${ARROW_SOURCE}"

thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch

@@ -0,0 +1,13 @@
+--- a/cpp/thirdparty/versions.txt
++++ b/cpp/thirdparty/versions.txt
+@@ -58,8 +58,8 @@
+ ARROW_AZURE_SDK_BUILD_SHA256_CHECKSUM=97065bfc971ac8df450853ce805f820f52b59457bd7556510186a1569502e4a1
+ ARROW_BOOST_BUILD_VERSION=1.88.0
+ ARROW_BOOST_BUILD_SHA256_CHECKSUM=dcea50f40ba1ecfc448fdf886c0165cf3e525fef2c9e3e080b9804e8117b9694
+-ARROW_BROTLI_BUILD_VERSION=v1.0.9
+-ARROW_BROTLI_BUILD_SHA256_CHECKSUM=f9e8d81d0405ba66d181529af42a3354f838c939095ff99930da6aa9cdf6fe46
++ARROW_BROTLI_BUILD_VERSION=v1.0.10
++ARROW_BROTLI_BUILD_SHA256_CHECKSUM=b517ebdb5266b963d28d6e639b973479874ec72086deb6ee4a2d639e1b13606b
+ ARROW_BZIP2_BUILD_VERSION=1.0.8
+ ARROW_BZIP2_BUILD_SHA256_CHECKSUM=ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269
+ ARROW_CARES_BUILD_VERSION=1.17.2

thirdparty/vars.sh

@@ -235,10 +235,12 @@ ZSTD_SOURCE=zstd-1.5.7
 ZSTD_MD5SUM="780fc1896922b1bc52a4e90980cdda48"
 
 # brotli
-BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.9.tar.gz"
-BROTLI_NAME="brotli-1.0.9.tar.gz"
-BROTLI_SOURCE="brotli-1.0.9"
-BROTLI_MD5SUM="c2274f0c7af8470ad514637c35bcee7d"
+# Arrow builds and BE statically links this decoder, so a system library update
+# cannot replace the vulnerable code fixed in 1.0.10 (CVE-2026-111497).
+BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.10.tar.gz"
+BROTLI_NAME="brotli-1.0.10.tar.gz"
+BROTLI_SOURCE="brotli-1.0.10"
+BROTLI_MD5SUM="830ce41562b2ec8cbdfe3f70111db0fa"
 
 # flatbuffers
 FLATBUFFERS_DOWNLOAD="https://github.com/google/flatbuffers/archive/v23.5.26.tar.gz"