github-actions[bot] commented on code in PR #69906: URL: https://github.com/apache/doris/pull/69906#discussion_r4430425141
########## thirdparty/vars.sh: ########## @@ -235,10 +235,12 @@ ZSTD_SOURCE=zstd-1.5.7 ZSTD_MD5SUM="780fc1896922b1bc52a4e90980cdda48" # brotli -BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.9.tar.gz"; -BROTLI_NAME="brotli-1.0.9.tar.gz" -BROTLI_SOURCE="brotli-1.0.9" -BROTLI_MD5SUM="c2274f0c7af8470ad514637c35bcee7d" +# Arrow builds and BE statically links this decoder, so a system library update +# cannot replace the vulnerable code fixed in 1.0.10 (CVE-2026-111497). +BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.10.tar.gz"; Review Comment: [P1] Invalidate existing third-party prefixes when Brotli changes. On Linux build.sh only checks the hadoop_hdfs_3_4/libhdfs and Lance/Paimon sentinels, and on macOS it accepts any unversioned libbrotlienc.a; neither detects a 1.0.9 payload. A complete prebuilt prefix therefore skips download-thirdparty.sh and the new Arrow patch, so the BE can still link the vulnerable decoder. Add a Brotli version/content sentinel or force/refresh the prebuilt dependency set. ########## thirdparty/download-thirdparty.sh: ########## @@ -480,6 +480,12 @@ if [[ " ${TP_ARCHIVES[*]} " =~ " ARROW " ]]; then patch -p1 <"${TP_PATCH_DIR}/apache-arrow-24.0.0-lzo.patch" touch "${PATCHED_MARK}" fi + # Arrow also verifies the overridden Brotli archive against its own SHA256. + # A separate marker updates sources that already have the other Arrow patches. + if [[ ! -f "${PATCHED_MARK}_brotli_1_0_10" ]]; then + patch -p1 <"${TP_PATCH_DIR}/apache-arrow-24.0.0-brotli-1.0.10.patch" Review Comment: [P2] Make the new Brotli patch marker restart-safe. If the process is killed after patch rewrites versions.txt but before touch writes patched_mark_brotli_1_0_10, the next run invokes plain patch again, treats the hunk as reversed, and exits under set -e. Verify the expected v1.0.10 content before patching or use a forward/idempotent patch mode before writing the marker. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
