This is an automated email from the ASF dual-hosted git repository.
Gabriel39 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 378404eeb12 [fix](thirdparty) Upgrade Brotli to 1.0.10 for
CVE-2026-111497 (#69906)
378404eeb12 is described below
commit 378404eeb12a1d646a5a5e725cf7f79e5170960e
Author: Gabriel <[email protected]>
AuthorDate: Mon Nov 2 10:10:45 2026 +0800
[fix](thirdparty) Upgrade Brotli to 1.0.10 for CVE-2026-111497 (#69906)
### What problem does this PR solve?
Issue Number: None
Related PR: None
Doris bundles Brotli 1.0.9, which is affected by
[CVE-2026-111497](https://github.com/google/brotli/releases/tag/v1.0.10).
The upstream decoder can mistake an invalid block switch for
insufficient input, allowing an out-of-bounds write.
Upgrade the bundled dependency to the upstream 1.0.10 security release
and update its archive checksum. Align Arrow 24's internal Brotli
version and SHA256 pin with the overridden archive; changing the Doris
manifest alone causes Arrow's ExternalProject verification to fail.
Apply that metadata patch with a separate marker so previously patched
Arrow source trees also receive it.
The fix requires rebuilding the relevant thirdparty libraries and
relinking BE because the decoder is statically linked.
### Release note
Upgrade bundled Brotli to 1.0.10 to include the upstream fix for
CVE-2026-111497.
### Check List (For Author)
- Test: Manual validation passed:
- Official source archive MD5 and SHA256 verification; the source
contains the upstream block-switch error fix.
- Bash syntax and `git diff --check`.
- Existing thirdparty download checksum and fallback tests.
- Actual Brotli/Arrow companion download and extraction; patch
application to previously patched Arrow sources and repeated invocation.
- Patch dry-run against pristine Arrow 24 metadata.
- Arrow 24's Brotli ExternalProject verification, build, and
static-library installation in an isolated CMake harness. Confirmed the
old SHA256 pin fails with the new archive before the patch, then passes
after it.
- Brotli 1.0.10 build and all 14 available upstream
round-trip/compatibility tests with AddressSanitizer and
UndefinedBehaviorSanitizer.
- Full Doris and Arrow builds were not run locally; CI validation is
requested.
- Behavior changed: Yes. Builds use the patched Brotli decoder and
updated Arrow dependency metadata.
- Does this need documentation: No. This updates a bundled security
dependency.
---
thirdparty/download-thirdparty.sh | 6 ++++++
thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch | 13 +++++++++++++
thirdparty/vars.sh | 10 ++++++----
3 files changed, 25 insertions(+), 4 deletions(-)
diff --git a/thirdparty/download-thirdparty.sh
b/thirdparty/download-thirdparty.sh
index c3183010b12..8ee65246a42 100755
--- a/thirdparty/download-thirdparty.sh
+++ b/thirdparty/download-thirdparty.sh
@@ -480,6 +480,12 @@ if [[ " ${TP_ARCHIVES[*]} " =~ " ARROW " ]]; then
patch -p1 <"${TP_PATCH_DIR}/apache-arrow-24.0.0-lzo.patch"
touch "${PATCHED_MARK}"
fi
+ # Arrow also verifies the overridden Brotli archive against its own
SHA256.
+ # A separate marker updates sources that already have the other Arrow
patches.
+ if [[ ! -f "${PATCHED_MARK}_brotli_1_0_10" ]]; then
+ patch -p1
<"${TP_PATCH_DIR}/apache-arrow-24.0.0-brotli-1.0.10.patch"
+ touch "${PATCHED_MARK}_brotli_1_0_10"
+ fi
cd -
fi
echo "Finished patching ${ARROW_SOURCE}"
diff --git a/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch
b/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch
new file mode 100644
index 00000000000..ca7b7c82ae0
--- /dev/null
+++ b/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch
@@ -0,0 +1,13 @@
+--- a/cpp/thirdparty/versions.txt
++++ b/cpp/thirdparty/versions.txt
+@@ -58,8 +58,8 @@
+
ARROW_AZURE_SDK_BUILD_SHA256_CHECKSUM=97065bfc971ac8df450853ce805f820f52b59457bd7556510186a1569502e4a1
+ ARROW_BOOST_BUILD_VERSION=1.88.0
+
ARROW_BOOST_BUILD_SHA256_CHECKSUM=dcea50f40ba1ecfc448fdf886c0165cf3e525fef2c9e3e080b9804e8117b9694
+-ARROW_BROTLI_BUILD_VERSION=v1.0.9
+-ARROW_BROTLI_BUILD_SHA256_CHECKSUM=f9e8d81d0405ba66d181529af42a3354f838c939095ff99930da6aa9cdf6fe46
++ARROW_BROTLI_BUILD_VERSION=v1.0.10
++ARROW_BROTLI_BUILD_SHA256_CHECKSUM=b517ebdb5266b963d28d6e639b973479874ec72086deb6ee4a2d639e1b13606b
+ ARROW_BZIP2_BUILD_VERSION=1.0.8
+
ARROW_BZIP2_BUILD_SHA256_CHECKSUM=ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269
+ ARROW_CARES_BUILD_VERSION=1.17.2
diff --git a/thirdparty/vars.sh b/thirdparty/vars.sh
index 027fe6f6523..6a08d306cef 100644
--- a/thirdparty/vars.sh
+++ b/thirdparty/vars.sh
@@ -235,10 +235,12 @@ ZSTD_SOURCE=zstd-1.5.7
ZSTD_MD5SUM="780fc1896922b1bc52a4e90980cdda48"
# brotli
-BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.9.tar.gz";
-BROTLI_NAME="brotli-1.0.9.tar.gz"
-BROTLI_SOURCE="brotli-1.0.9"
-BROTLI_MD5SUM="c2274f0c7af8470ad514637c35bcee7d"
+# Arrow builds and BE statically links this decoder, so a system library update
+# cannot replace the vulnerable code fixed in 1.0.10 (CVE-2026-111497).
+BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.10.tar.gz";
+BROTLI_NAME="brotli-1.0.10.tar.gz"
+BROTLI_SOURCE="brotli-1.0.10"
+BROTLI_MD5SUM="830ce41562b2ec8cbdfe3f70111db0fa"
# flatbuffers
FLATBUFFERS_DOWNLOAD="https://github.com/google/flatbuffers/archive/v23.5.26.tar.gz";
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
