From bc66e2384e726f6a81b676a6ccbb427cd0f9d555 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Wed, 23 Sep 2026 10:36:40 +0800 Subject: [PATCH] =?UTF-8?q?Fix=20CVE-2026-44236:=20enforce=20AMQP=5FFRAME?= =?UTF-8?q?=5FMIN=5FSIZE=20during=20connection.tune=20to=20prevent=20out-o?= =?UTF-8?q?f-bounds=20wri=E2=80=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- librabbitmq.spec | 7 +- rabbitmq-c-CVE-2026-44236.patch | 139 ++++++++++++++++++++++++++++++++ 2 files changed, 145 insertions(+), 1 deletion(-) create mode 100644 rabbitmq-c-CVE-2026-44236.patch diff --git a/librabbitmq.spec b/librabbitmq.spec index a265057..c10b119 100644 --- a/librabbitmq.spec +++ b/librabbitmq.spec @@ -4,12 +4,13 @@ Summary: Client library for AMQP Name: librabbitmq Version: 0.13.0 -Release: 4%{?dist} +Release: 5%{?dist} License: MIT URL: https://github.com/alanxz/rabbitmq-c Source0: %{url}/archive/refs/tags/v%{version}.tar.gz Patch0001: rabbitmq-c-CVE-2023-35789.patch +Patch0002: rabbitmq-c-CVE-2026-44236.patch BuildRequires: gcc cmake openssl-devel popt-devel xmlto make @@ -84,6 +85,10 @@ grep static %{buildroot}%{_libdir}/cmake/rabbitmq-c/*.cmake && exit 1 %changelog +* Wed Sep 23 2026 PkgAgent Robot - 0.13.0-5 +- [Type] security +- [DESC] Fix CVE-2026-44236: enforce AMQP_FRAME_MIN_SIZE during connection.tune to prevent out-of-bounds write + * Thu Sep 26 2024 OpenCloudOS Release Engineering - 0.13.0-4 - Rebuilt for clarifying the packages requirement in BaseOS and AppStream diff --git a/rabbitmq-c-CVE-2026-44236.patch b/rabbitmq-c-CVE-2026-44236.patch new file mode 100644 index 0000000..4a74093 --- /dev/null +++ b/rabbitmq-c-CVE-2026-44236.patch @@ -0,0 +1,139 @@ +From 4777d0b5c58cb02966a04a85832436bd66ed5d1f Mon Sep 17 00:00:00 2001 +From: Kevin Valerio +Date: Tue, 28 Apr 2026 13:45:22 +0200 +Subject: [PATCH] fix(connection): enforce minimum frame_max + +--- + README.md | 6 ++++- + librabbitmq/amqp_connection.c | 4 +++ + librabbitmq/amqp_socket.c | 1 + + tests/CMakeLists.txt | 5 +++- + tests/test_tune_connection.c | 51 +++++++++++++++++++++++++++++++++++ + 5 files changed, 65 insertions(+), 2 deletions(-) + create mode 100644 tests/test_tune_connection.c +diff --git a/README.md b/README.md +index e4e2544..010c35d 100644 +--- a/README.md ++++ b/README.md +@@ -129,6 +129,10 @@ terminal window: + Please see the `examples` directory for short examples of the use of + the `librabbitmq` library. + ++During login, `frame_max` negotiation follows the AMQP minimum frame size. ++Values below `AMQP_FRAME_MIN_SIZE` are raised before the client sizes its ++outbound frame buffer or sends `connection.tune-ok`. ++ + ### Threading + + You cannot share a socket, an `amqp_connection_state_t`, or a channel +@@ -173,4 +177,4 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +-SOFTWARE. +\ No newline at end of file ++SOFTWARE. +diff --git a/librabbitmq/amqp_connection.c b/librabbitmq/amqp_connection.c +index 7763a4c..150bb58 100644 +--- a/librabbitmq/amqp_connection.c ++++ b/librabbitmq/amqp_connection.c +@@ -113,6 +113,10 @@ int amqp_tune_connection(amqp_connection_state_t state, int channel_max, + + ENFORCE_STATE(state, CONNECTION_STATE_IDLE); + ++ if (frame_max < AMQP_FRAME_MIN_SIZE) { ++ frame_max = AMQP_FRAME_MIN_SIZE; ++ } ++ + state->channel_max = channel_max; + state->frame_max = frame_max; + +diff --git a/librabbitmq/amqp_socket.c b/librabbitmq/amqp_socket.c +index 78ab63f..7df04d0 100644 +--- a/librabbitmq/amqp_socket.c ++++ b/librabbitmq/amqp_socket.c +@@ -1387,6 +1387,7 @@ static amqp_rpc_reply_t amqp_login_inner(amqp_connection_state_t state, + if (res < 0) { + goto error_res; + } ++ client_frame_max = (uint32_t)amqp_get_frame_max(state); + + { + amqp_connection_tune_ok_t s; +diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt +index 8c0aee0..624e7f5 100644 +--- a/tests/CMakeLists.txt ++++ b/tests/CMakeLists.txt +@@ -23,6 +23,10 @@ add_executable(test_status_enum + target_link_libraries(test_status_enum rabbitmq-static) + add_test(status_enum test_status_enum) + ++add_executable(test_tune_connection test_tune_connection.c) ++target_link_libraries(test_tune_connection rabbitmq-static) ++add_test(tune_connection test_tune_connection) ++ + add_executable(test_basic + test_basic.c) + target_link_libraries(test_basic rabbitmq-static) +@@ -40,4 +44,3 @@ add_test(sasl_mechanism test_sasl_mechanism) + add_executable(test_merge_capabilities test_merge_capabilities.c) + target_link_libraries(test_merge_capabilities rabbitmq-static) + add_test(merge_capabilities test_merge_capabilities) +- +diff --git a/tests/test_tune_connection.c b/tests/test_tune_connection.c +new file mode 100644 +index 0000000..276e18d +--- /dev/null ++++ b/tests/test_tune_connection.c +@@ -0,0 +1,51 @@ ++// Copyright 2007 - 2021, Alan Antonuk and the rabbitmq-c contributors. ++// SPDX-License-Identifier: mit ++ ++#include "amqp_private.h" ++#include ++#include ++ ++#include ++#include ++ ++static void expect_frame_max(int requested, int expected) { ++ int res; ++ amqp_connection_state_t state = amqp_new_connection(); ++ ++ if (state == NULL) { ++ fprintf(stderr, "amqp_new_connection failed\n"); ++ abort(); ++ } ++ ++ state->state = CONNECTION_STATE_IDLE; ++ ++ res = amqp_tune_connection(state, 0, requested, 0); ++ if (res != AMQP_STATUS_OK) { ++ fprintf(stderr, "amqp_tune_connection returned %d\n", res); ++ abort(); ++ } ++ ++ if (amqp_get_frame_max(state) != expected) { ++ fprintf(stderr, "expected frame_max %d, got %d\n", expected, ++ amqp_get_frame_max(state)); ++ abort(); ++ } ++ ++ if (state->outbound_buffer.len != (size_t)expected) { ++ fprintf(stderr, "expected outbound buffer length %d, got %zu\n", expected, ++ state->outbound_buffer.len); ++ abort(); ++ } ++ ++ amqp_destroy_connection(state); ++} ++ ++int main(void) { ++ expect_frame_max(0, AMQP_FRAME_MIN_SIZE); ++ expect_frame_max(1, AMQP_FRAME_MIN_SIZE); ++ expect_frame_max(AMQP_FRAME_MIN_SIZE - 1, AMQP_FRAME_MIN_SIZE); ++ expect_frame_max(AMQP_FRAME_MIN_SIZE, AMQP_FRAME_MIN_SIZE); ++ expect_frame_max(AMQP_DEFAULT_FRAME_SIZE, AMQP_DEFAULT_FRAME_SIZE); ++ ++ return 0; ++} -- Gitee