From 378404eeb12a1d646a5a5e725cf7f79e5170960e Mon Sep 17 00:00:00 2001 From: Gabriel Date: Mon, 2 Nov 2026 10:10:45 +0800 Subject: [PATCH] [fix](thirdparty) Upgrade Brotli to 1.0.10 for CVE-2026-111497 (#69906) ### What problem does this PR solve? Issue Number: None Related PR: None Doris bundles Brotli 1.0.9, which is affected by [CVE-2026-111497](https://github.com/google/brotli/releases/tag/v1.0.10). The upstream decoder can mistake an invalid block switch for insufficient input, allowing an out-of-bounds write. Upgrade the bundled dependency to the upstream 1.0.10 security release and update its archive checksum. Align Arrow 24's internal Brotli version and SHA256 pin with the overridden archive; changing the Doris manifest alone causes Arrow's ExternalProject verification to fail. Apply that metadata patch with a separate marker so previously patched Arrow source trees also receive it. The fix requires rebuilding the relevant thirdparty libraries and relinking BE because the decoder is statically linked. ### Release note Upgrade bundled Brotli to 1.0.10 to include the upstream fix for CVE-2026-111497. ### Check List (For Author) - Test: Manual validation passed: - Official source archive MD5 and SHA256 verification; the source contains the upstream block-switch error fix. - Bash syntax and `git diff --check`. - Existing thirdparty download checksum and fallback tests. - Actual Brotli/Arrow companion download and extraction; patch application to previously patched Arrow sources and repeated invocation. - Patch dry-run against pristine Arrow 24 metadata. - Arrow 24's Brotli ExternalProject verification, build, and static-library installation in an isolated CMake harness. Confirmed the old SHA256 pin fails with the new archive before the patch, then passes after it. - Brotli 1.0.10 build and all 14 available upstream round-trip/compatibility tests with AddressSanitizer and UndefinedBehaviorSanitizer. - Full Doris and Arrow builds were not run locally; CI validation is requested. - Behavior changed: Yes. Builds use the patched Brotli decoder and updated Arrow dependency metadata. - Does this need documentation: No. This updates a bundled security dependency. --- thirdparty/download-thirdparty.sh | 6 ++++++ .../patches/apache-arrow-24.0.0-brotli-1.0.10.patch | 13 +++++++++++++ thirdparty/vars.sh | 10 ++++++---- 3 files changed, 25 insertions(+), 4 deletions(-) create mode 100644 thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch diff --git a/thirdparty/download-thirdparty.sh b/thirdparty/download-thirdparty.sh index c3183010b12..8ee65246a42 100755 --- a/thirdparty/download-thirdparty.sh +++ b/thirdparty/download-thirdparty.sh @@ -480,6 +480,12 @@ if [[ " ${TP_ARCHIVES[*]} " =~ " ARROW " ]]; then patch -p1 <"${TP_PATCH_DIR}/apache-arrow-24.0.0-lzo.patch" touch "${PATCHED_MARK}" fi + # Arrow also verifies the overridden Brotli archive against its own SHA256. + # A separate marker updates sources that already have the other Arrow patches. + if [[ ! -f "${PATCHED_MARK}_brotli_1_0_10" ]]; then + patch -p1 <"${TP_PATCH_DIR}/apache-arrow-24.0.0-brotli-1.0.10.patch" + touch "${PATCHED_MARK}_brotli_1_0_10" + fi cd - fi echo "Finished patching ${ARROW_SOURCE}" diff --git a/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch b/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch new file mode 100644 index 00000000000..ca7b7c82ae0 --- /dev/null +++ b/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch @@ -0,0 +1,13 @@ +--- a/cpp/thirdparty/versions.txt ++++ b/cpp/thirdparty/versions.txt +@@ -58,8 +58,8 @@ + ARROW_AZURE_SDK_BUILD_SHA256_CHECKSUM=97065bfc971ac8df450853ce805f820f52b59457bd7556510186a1569502e4a1 + ARROW_BOOST_BUILD_VERSION=1.88.0 + ARROW_BOOST_BUILD_SHA256_CHECKSUM=dcea50f40ba1ecfc448fdf886c0165cf3e525fef2c9e3e080b9804e8117b9694 +-ARROW_BROTLI_BUILD_VERSION=v1.0.9 +-ARROW_BROTLI_BUILD_SHA256_CHECKSUM=f9e8d81d0405ba66d181529af42a3354f838c939095ff99930da6aa9cdf6fe46 ++ARROW_BROTLI_BUILD_VERSION=v1.0.10 ++ARROW_BROTLI_BUILD_SHA256_CHECKSUM=b517ebdb5266b963d28d6e639b973479874ec72086deb6ee4a2d639e1b13606b + ARROW_BZIP2_BUILD_VERSION=1.0.8 + ARROW_BZIP2_BUILD_SHA256_CHECKSUM=ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269 + ARROW_CARES_BUILD_VERSION=1.17.2 diff --git a/thirdparty/vars.sh b/thirdparty/vars.sh index 027fe6f6523..6a08d306cef 100644 --- a/thirdparty/vars.sh +++ b/thirdparty/vars.sh @@ -235,10 +235,12 @@ ZSTD_SOURCE=zstd-1.5.7 ZSTD_MD5SUM="780fc1896922b1bc52a4e90980cdda48" # brotli -BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.9.tar.gz" -BROTLI_NAME="brotli-1.0.9.tar.gz" -BROTLI_SOURCE="brotli-1.0.9" -BROTLI_MD5SUM="c2274f0c7af8470ad514637c35bcee7d" +# Arrow builds and BE statically links this decoder, so a system library update +# cannot replace the vulnerable code fixed in 1.0.10 (CVE-2026-111497). +BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.10.tar.gz" +BROTLI_NAME="brotli-1.0.10.tar.gz" +BROTLI_SOURCE="brotli-1.0.10" +BROTLI_MD5SUM="830ce41562b2ec8cbdfe3f70111db0fa" # flatbuffers FLATBUFFERS_DOWNLOAD="https://github.com/google/flatbuffers/archive/v23.5.26.tar.gz"