This is an automated email from the ASF dual-hosted git repository.
kou pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow.git
The following commit(s) were added to refs/heads/main by this push:
new c7944b35f3 GH-51354: [C++][Parquet] Update bundled Apache Thrift to
0.24.0 (#51559)
c7944b35f3 is described below
commit c7944b35f3cbcd38dbc607b7405833e82697c7b7
Author: Hanayoshi-8744 <[email protected]>
AuthorDate: Thu Oct 8 18:22:16 2026 +0900
GH-51354: [C++][Parquet] Update bundled Apache Thrift to 0.24.0 (#51559)
### Rationale for this change
The bundled Apache Thrift dependency (0.22.0) is affected by
CVE-2026-55969, an integer overflow vulnerability in
`TTransport::checkReadBytesAvailable()` that could bypass message
size checks when reading maliciously crafted Thrift-encoded data.
Arrow's Parquet module relies on Thrift's compact protocol to
deserialize Parquet file metadata, so this is relevant to Arrow.
### What changes are included in this PR?
- Bump the bundled Apache Thrift version from 0.22.0 to 0.24.0 in
`cpp/thirdparty/versions.txt` (including the SHA256 checksum).
- Remove the Clang-only `thrift-3187.patch` and its application logic
in `ThirdpartyToolchain.cmake`. This patch pre-applied Thrift's
upstream fix for THRIFT-3268 (a compiler warning), which has since
been merged into Thrift itself and is already included in 0.24.0.
Keeping the patch would make `git apply`/`patch` fail during the
bundled build with Clang.
### Are these changes tested?
- Verified that `thrift-0.24.0.tar.gz` downloads correctly and its
SHA256 checksum matches the value published at
downloads.apache.org.
- Confirmed the CVE fix is present in Thrift 0.24.0 by diffing
`TProtocol.h`, `TCompactProtocol.h`, `TBinaryProtocol.h`, and
`TTransport.h` against 0.22.0.
- Confirmed `thrift-3187.patch` no longer applies cleanly against
0.24.0 sources (already fixed upstream), which is why it was
removed rather than kept as a no-op.
- Built Arrow C++ locally on macOS (arm64, AppleClang) with
`-DARROW_PARQUET=ON -DARROW_BUILD_TESTS=ON -DThrift_SOURCE=BUNDLED`,
on top of the latest `main` (after rebasing), and ran the following
Parquet tests. All of them passed with no failures (some tests were
skipped, e.g. those requiring Snappy, which was not enabled in my
build):
`parquet-internals-test`, `parquet-file-deserialize-test`,
`parquet-schema-test`, `parquet-reader-test`,
`parquet-writer-test`, `parquet-arrow-reader-writer-test`,
`parquet-arrow-metadata-test`, `parquet-arrow-index-test`, and
`parquet-arrow-internals-test`.
- Not tested locally: the removed patch was only applied for
`CMAKE_CXX_COMPILER_ID STREQUAL "Clang"`, which my AppleClang build
does not hit, so building the bundled Thrift with Clang on Linux
relies on CI. I also did not test encryption, Windows/MSVC, or the
Python/R packaging builds locally.
### Are there any user-facing changes?
No.
* GitHub Issue: #51354
---
Disclosure: this change was prepared with the assistance of an AI
coding tool (Claude Code). I reviewed the diff, verified the CVE fix
and checksum myself, and ran the test suite locally before opening
this PR.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Authored-by: Hanayoshi-8744
<[email protected]>
Signed-off-by: Sutou Kouhei <[email protected]>
---
cpp/cmake_modules/ThirdpartyToolchain.cmake | 21 ----
cpp/cmake_modules/thrift-3187.patch | 162 ----------------------------
cpp/thirdparty/versions.txt | 4 +-
3 files changed, 2 insertions(+), 185 deletions(-)
diff --git a/cpp/cmake_modules/ThirdpartyToolchain.cmake
b/cpp/cmake_modules/ThirdpartyToolchain.cmake
index 42da1eb425..01e1ab147a 100644
--- a/cpp/cmake_modules/ThirdpartyToolchain.cmake
+++ b/cpp/cmake_modules/ThirdpartyToolchain.cmake
@@ -1816,29 +1816,8 @@ function(build_thrift)
if(CMAKE_VERSION VERSION_LESS 3.26)
message(FATAL_ERROR "Require CMake 3.26 or later for building bundled
Apache Thrift")
endif()
- set(THRIFT_PATCH_COMMAND)
- if(CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
- find_program(PATCH patch)
- if(PATCH)
- list(APPEND
- THRIFT_PATCH_COMMAND
- ${PATCH}
- -p1
- -i)
- else()
- find_program(GIT git)
- if(GIT)
- list(APPEND THRIFT_PATCH_COMMAND ${GIT} apply)
- endif()
- endif()
- if(THRIFT_PATCH_COMMAND)
- # https://github.com/apache/thrift/pull/3187
- list(APPEND THRIFT_PATCH_COMMAND
${CMAKE_CURRENT_LIST_DIR}/thrift-3187.patch)
- endif()
- endif()
fetchcontent_declare(thrift
${FC_DECLARE_COMMON_OPTIONS}
- PATCH_COMMAND ${THRIFT_PATCH_COMMAND}
URL ${THRIFT_SOURCE_URL}
URL_HASH "SHA256=${ARROW_THRIFT_BUILD_SHA256_CHECKSUM}")
diff --git a/cpp/cmake_modules/thrift-3187.patch
b/cpp/cmake_modules/thrift-3187.patch
deleted file mode 100644
index 44a9161488..0000000000
--- a/cpp/cmake_modules/thrift-3187.patch
+++ /dev/null
@@ -1,162 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-From ad893633097b05ecdba8aa0f27aaf173dc7839b2 Mon Sep 17 00:00:00 2001
-From: Sutou Kouhei <[email protected]>
-Date: Fri, 8 Aug 2025 16:19:10 +0900
-Subject: [PATCH] THRIFT-3268: Suppress gnu-zero-variadic-macro-arguments
- warnings
-
-Client: cpp
-
-We can reproduce these warnings by:
-
- CC=clang CXX=clang++ \
- cmake \
- -S . \
- -B ../thrift.build \
- -DWITH_{AS3,JAVA,JAVASCRIPT,NODEJS,PYTHON,C_GLIB}=OFF \
- -DCMAKE_CXX_FLAGS="-Wgnu-zero-variadic-macro-arguments"
- cmake --build ../thrift.build
-
-Sample warning:
-
- lib/cpp/src/thrift/TLogging.h:119:13: warning: token pasting of ',' and
__VA_ARGS__ is a GNU extension [-Wgnu-zero-variadic-macro-arguments]
- 119 | ##__VA_ARGS__);
\
- | ^
----
- lib/cpp/src/thrift/TLogging.h | 12 ++++++------
- lib/cpp/test/TransportTest.cpp | 12 ++++++------
- lib/cpp/test/ZlibTest.cpp | 6 ++----
- 3 files changed, 14 insertions(+), 16 deletions(-)
-
-diff --git a/lib/cpp/src/thrift/TLogging.h b/lib/cpp/src/thrift/TLogging.h
-index 07ff030f7da..64e9bf80bbb 100644
---- a/lib/cpp/src/thrift/TLogging.h
-+++ b/lib/cpp/src/thrift/TLogging.h
-@@ -55,7 +55,7 @@
- #if T_GLOBAL_DEBUGGING_LEVEL > 0
- #define T_DEBUG(format_string, ...)
\
- if (T_GLOBAL_DEBUGGING_LEVEL > 0) {
\
-- fprintf(stderr, "[%s,%d] " format_string " \n", __FILE__, __LINE__,
##__VA_ARGS__); \
-+ fprintf(stderr, "[%s,%d] " format_string " \n", __FILE__, __LINE__,
__VA_ARGS__); \
- }
- #else
- #define T_DEBUG(format_string, ...)
-@@ -80,7 +80,7 @@
- __FILE__,
\
- __LINE__,
\
- dbgtime,
\
-- ##__VA_ARGS__);
\
-+ __VA_ARGS__);
\
- }
\
- }
- #else
-@@ -96,7 +96,7 @@
- */
- #define T_DEBUG_L(level, format_string, ...)
\
- if ((level) > 0) {
\
-- fprintf(stderr, "[%s,%d] " format_string " \n", __FILE__, __LINE__,
##__VA_ARGS__); \
-+ fprintf(stderr, "[%s,%d] " format_string " \n", __FILE__, __LINE__,
__VA_ARGS__); \
- }
-
- /**
-@@ -116,7 +116,7 @@
- __FILE__,
\
- __LINE__,
\
- dbgtime,
\
-- ##__VA_ARGS__);
\
-+ __VA_ARGS__);
\
- }
-
- /**
-@@ -137,7 +137,7 @@
- __FILE__,
\
- __LINE__,
\
- dbgtime,
\
-- ##__VA_ARGS__);
\
-+ __VA_ARGS__);
\
- exit(1);
\
- }
-
-@@ -155,7 +155,7 @@
- time(&now);
\
- THRIFT_CTIME_R(&now, dbgtime);
\
- dbgtime[24] = '\0';
\
-- fprintf(stderr, "[%s] " format_string " \n", dbgtime, ##__VA_ARGS__);
\
-+ fprintf(stderr, "[%s] " format_string " \n", dbgtime, __VA_ARGS__);
\
- }
\
- }
- #else
-diff --git a/lib/cpp/test/TransportTest.cpp b/lib/cpp/test/TransportTest.cpp
-index d6d38595a6b..8a05465773a 100644
---- a/lib/cpp/test/TransportTest.cpp
-+++ b/lib/cpp/test/TransportTest.cpp
-@@ -784,23 +784,23 @@ void test_borrow_none_available() {
- **************************************************************************/
-
- #define ADD_TEST_RW(CoupledTransports, totalSize, ...)
\
-- addTestRW<CoupledTransports>(BOOST_STRINGIZE(CoupledTransports), totalSize,
##__VA_ARGS__);
-+ addTestRW<CoupledTransports>(BOOST_STRINGIZE(CoupledTransports), totalSize,
__VA_ARGS__);
-
- #define TEST_RW(CoupledTransports, totalSize, ...)
\
- do {
\
- /* Add the test as specified, to test the non-virtual function calls */
\
-- ADD_TEST_RW(CoupledTransports, totalSize, ##__VA_ARGS__);
\
-+ ADD_TEST_RW(CoupledTransports, totalSize, __VA_ARGS__);
\
- /*
\
- * Also test using the transport as a TTransport*, to test
\
- * the read_virt()/write_virt() calls
\
- */
\
-- ADD_TEST_RW(CoupledTTransports<CoupledTransports>, totalSize,
##__VA_ARGS__); \
-+ ADD_TEST_RW(CoupledTTransports<CoupledTransports>, totalSize,
__VA_ARGS__); \
- /* Test wrapping the transport with TBufferedTransport */
\
-- ADD_TEST_RW(CoupledBufferedTransportsT<CoupledTransports>, totalSize,
##__VA_ARGS__); \
-+ ADD_TEST_RW(CoupledBufferedTransportsT<CoupledTransports>, totalSize,
__VA_ARGS__); \
- /* Test wrapping the transport with TFramedTransports */
\
-- ADD_TEST_RW(CoupledFramedTransportsT<CoupledTransports>, totalSize,
##__VA_ARGS__); \
-+ ADD_TEST_RW(CoupledFramedTransportsT<CoupledTransports>, totalSize,
__VA_ARGS__); \
- /* Test wrapping the transport with TZlibTransport */
\
-- ADD_TEST_RW(CoupledZlibTransportsT<CoupledTransports>, totalSize,
##__VA_ARGS__); \
-+ ADD_TEST_RW(CoupledZlibTransportsT<CoupledTransports>, totalSize,
__VA_ARGS__); \
- } while (0)
-
- #define ADD_TEST_BLOCKING(CoupledTransports)
\
-diff --git a/lib/cpp/test/ZlibTest.cpp b/lib/cpp/test/ZlibTest.cpp
-index 274a243913c..ea9c617f625 100644
---- a/lib/cpp/test/ZlibTest.cpp
-+++ b/lib/cpp/test/ZlibTest.cpp
-@@ -347,8 +347,7 @@ void test_get_underlying_transport() {
- do {
\
- ::std::ostringstream name_ss;
\
- name_ss << name << "-" << BOOST_STRINGIZE(_FUNC);
\
-- ::std::function<void ()> test_func =
\
-- ::std::bind(_FUNC, ##__VA_ARGS__);
\
-+ ::std::function<void ()> test_func = ::std::bind(_FUNC, __VA_ARGS__);
\
- ::boost::unit_test::test_case* tc
\
- = ::boost::unit_test::make_test_case(test_func, name_ss.str(),
__FILE__, __LINE__); \
- (suite)->add(tc);
\
-@@ -359,8 +358,7 @@ void test_get_underlying_transport() {
- ::std::ostringstream name_ss;
\
- name_ss << name << "-" << BOOST_STRINGIZE(_FUNC);
\
- ::boost::unit_test::test_case* tc
\
-- = ::boost::unit_test::make_test_case(::std::bind(_FUNC,
\
--
##__VA_ARGS__), \
-+ = ::boost::unit_test::make_test_case(::std::bind(_FUNC, __VA_ARGS__),
\
- name_ss.str());
\
- (suite)->add(tc);
\
- } while (0)
diff --git a/cpp/thirdparty/versions.txt b/cpp/thirdparty/versions.txt
index 1cdffde80c..050275c437 100644
--- a/cpp/thirdparty/versions.txt
+++ b/cpp/thirdparty/versions.txt
@@ -110,8 +110,8 @@ ARROW_SUBSTRAIT_BUILD_VERSION=v0.44.0
ARROW_SUBSTRAIT_BUILD_SHA256_CHECKSUM=f989a862f694e7dbb695925ddb7c4ce06aa6c51aca945105c075139aed7e55a2
ARROW_S2N_TLS_BUILD_VERSION=v1.7.0
ARROW_S2N_TLS_BUILD_SHA256_CHECKSUM=a6e8228e238239bb3c17b1eda3ed702bcbb2eaebc792eac4d754cc5619b0ea06
-ARROW_THRIFT_BUILD_VERSION=0.22.0
-ARROW_THRIFT_BUILD_SHA256_CHECKSUM=794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5
+ARROW_THRIFT_BUILD_VERSION=0.24.0
+ARROW_THRIFT_BUILD_SHA256_CHECKSUM=e0fa5839a4c5c1d631b0931cf2c554ebbfa4e2fee3a9fb3ffd4f82ce4396c6e4
ARROW_URIPARSER_BUILD_VERSION=1.0.2
ARROW_URIPARSER_BUILD_SHA256_CHECKSUM=dd2e4843f43de6f5aedf430e530f1e2d159eba8ca4d64c2787af1c20f707a9e4
ARROW_UTF8PROC_BUILD_VERSION=v2.10.0
