[oe][meta-oe][wrynose][PATCH 2/24] rabbitmq-c: patch CVE-2026-44236

[ankur.tyagi85@gmail.com]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44236

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../rabbitmq-c/CVE-2026-44236.patch           | 145 ++++++++++++++++++
 .../rabbitmq-c/rabbitmq-c_0.15.0.bb           |   1 +
 2 files changed, 146 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/rabbitmq-c/rabbitmq-c/CVE-2026-44236.patch

diff --git a/meta-oe/recipes-connectivity/rabbitmq-c/rabbitmq-c/CVE-2026-44236.patch b/meta-oe/recipes-connectivity/rabbitmq-c/rabbitmq-c/CVE-2026-44236.patch
new file mode 100644
index 0000000000..3c8a5a71a3
--- /dev/null
+++ b/meta-oe/recipes-connectivity/rabbitmq-c/rabbitmq-c/CVE-2026-44236.patch
@@ -0,0 +1,145 @@
+From 17f19124ba26f9c924f9ab53bca975cb8673f862 Mon Sep 17 00:00:00 2001
+From: Kevin Valerio <kvalerio@protonmail.com>
+Date: Tue, 28 Apr 2026 13:45:22 +0200
+Subject: [PATCH] fix(connection): enforce minimum frame_max
+
+(cherry picked from commit 4777d0b5c58cb02966a04a85832436bd66ed5d1f)
+
+CVE: CVE-2026-44236
+Upstream-Status: Backport [https://github.com/alanxz/rabbitmq-c/commit/4777d0b5c58cb02966a04a85832436bd66ed5d1f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ README.md                     |  6 ++++-
+ librabbitmq/amqp_connection.c |  4 +++
+ librabbitmq/amqp_socket.c     |  1 +
+ tests/CMakeLists.txt          |  5 +++-
+ tests/test_tune_connection.c  | 51 +++++++++++++++++++++++++++++++++++
+ 5 files changed, 65 insertions(+), 2 deletions(-)
+ create mode 100644 tests/test_tune_connection.c
+
+diff --git a/README.md b/README.md
+index 7c02d52..2682993 100644
+--- a/README.md
++++ b/README.md
+@@ -133,6 +133,10 @@ terminal window:
+ Please see the `examples` directory for short examples of the use of
+ the `librabbitmq` library.
+ 
++During login, `frame_max` negotiation follows the AMQP minimum frame size.
++Values below `AMQP_FRAME_MIN_SIZE` are raised before the client sizes its
++outbound frame buffer or sends `connection.tune-ok`.
++
+ ### Threading
+ 
+ You cannot share a socket, an `amqp_connection_state_t`, or a channel
+@@ -177,4 +181,4 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+-SOFTWARE.
+\ No newline at end of file
++SOFTWARE.
+diff --git a/librabbitmq/amqp_connection.c b/librabbitmq/amqp_connection.c
+index 4326ef7..f016fc1 100644
+--- a/librabbitmq/amqp_connection.c
++++ b/librabbitmq/amqp_connection.c
+@@ -113,6 +113,10 @@ int amqp_tune_connection(amqp_connection_state_t state, int channel_max,
+ 
+   ENFORCE_STATE(state, CONNECTION_STATE_IDLE);
+ 
++  if (frame_max < AMQP_FRAME_MIN_SIZE) {
++    frame_max = AMQP_FRAME_MIN_SIZE;
++  }
++
+   state->channel_max = channel_max;
+   state->frame_max = frame_max;
+ 
+diff --git a/librabbitmq/amqp_socket.c b/librabbitmq/amqp_socket.c
+index 094ceb7..a7206c7 100644
+--- a/librabbitmq/amqp_socket.c
++++ b/librabbitmq/amqp_socket.c
+@@ -1387,6 +1387,7 @@ static amqp_rpc_reply_t amqp_login_inner(amqp_connection_state_t state,
+   if (res < 0) {
+     goto error_res;
+   }
++  client_frame_max = (uint32_t)amqp_get_frame_max(state);
+ 
+   {
+     amqp_connection_tune_ok_t s;
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index 8c0aee0..624e7f5 100644
+--- a/tests/CMakeLists.txt
++++ b/tests/CMakeLists.txt
+@@ -23,6 +23,10 @@ add_executable(test_status_enum
+ target_link_libraries(test_status_enum rabbitmq-static)
+ add_test(status_enum test_status_enum)
+ 
++add_executable(test_tune_connection test_tune_connection.c)
++target_link_libraries(test_tune_connection rabbitmq-static)
++add_test(tune_connection test_tune_connection)
++
+ add_executable(test_basic
+                test_basic.c)
+ target_link_libraries(test_basic rabbitmq-static)
+@@ -40,4 +44,3 @@ add_test(sasl_mechanism test_sasl_mechanism)
+ add_executable(test_merge_capabilities test_merge_capabilities.c)
+ target_link_libraries(test_merge_capabilities rabbitmq-static)
+ add_test(merge_capabilities test_merge_capabilities)
+-
+diff --git a/tests/test_tune_connection.c b/tests/test_tune_connection.c
+new file mode 100644
+index 0000000..276e18d
+--- /dev/null
++++ b/tests/test_tune_connection.c
+@@ -0,0 +1,51 @@
++// Copyright 2007 - 2021, Alan Antonuk and the rabbitmq-c contributors.
++// SPDX-License-Identifier: mit
++
++#include "amqp_private.h"
++#include <rabbitmq-c/amqp.h>
++#include <rabbitmq-c/framing.h>
++
++#include <stdio.h>
++#include <stdlib.h>
++
++static void expect_frame_max(int requested, int expected) {
++  int res;
++  amqp_connection_state_t state = amqp_new_connection();
++
++  if (state == NULL) {
++    fprintf(stderr, "amqp_new_connection failed\n");
++    abort();
++  }
++
++  state->state = CONNECTION_STATE_IDLE;
++
++  res = amqp_tune_connection(state, 0, requested, 0);
++  if (res != AMQP_STATUS_OK) {
++    fprintf(stderr, "amqp_tune_connection returned %d\n", res);
++    abort();
++  }
++
++  if (amqp_get_frame_max(state) != expected) {
++    fprintf(stderr, "expected frame_max %d, got %d\n", expected,
++            amqp_get_frame_max(state));
++    abort();
++  }
++
++  if (state->outbound_buffer.len != (size_t)expected) {
++    fprintf(stderr, "expected outbound buffer length %d, got %zu\n", expected,
++            state->outbound_buffer.len);
++    abort();
++  }
++
++  amqp_destroy_connection(state);
++}
++
++int main(void) {
++  expect_frame_max(0, AMQP_FRAME_MIN_SIZE);
++  expect_frame_max(1, AMQP_FRAME_MIN_SIZE);
++  expect_frame_max(AMQP_FRAME_MIN_SIZE - 1, AMQP_FRAME_MIN_SIZE);
++  expect_frame_max(AMQP_FRAME_MIN_SIZE, AMQP_FRAME_MIN_SIZE);
++  expect_frame_max(AMQP_DEFAULT_FRAME_SIZE, AMQP_DEFAULT_FRAME_SIZE);
++
++  return 0;
++}
diff --git a/meta-oe/recipes-connectivity/rabbitmq-c/rabbitmq-c_0.15.0.bb b/meta-oe/recipes-connectivity/rabbitmq-c/rabbitmq-c_0.15.0.bb
index 642e1e443b..f3c2a52fa2 100644
--- a/meta-oe/recipes-connectivity/rabbitmq-c/rabbitmq-c_0.15.0.bb
+++ b/meta-oe/recipes-connectivity/rabbitmq-c/rabbitmq-c_0.15.0.bb
@@ -5,6 +5,7 @@ LICENSE = "MIT"
 
 SRC_URI = "git://github.com/alanxz/rabbitmq-c.git;branch=master;protocol=https \
            file://CVE-2026-44235.patch \
+           file://CVE-2026-44236.patch \
 "
 SRCREV = "84b81cd97a1b5515d3d4b304796680da24c666d8"