new file mode 100644
@@ -0,0 +1,74 @@
+From a927a964d462e9966864b7b2c432942b61038d6b Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Mon, 13 Jul 2026 09:27:02 +0700
+Subject: [PATCH] Merge commit from fork
+
+The AVI player used a chunk length taken from the input file as the
+number of bytes to read into the video frame buffer, whose capacity is
+derived from the (also file-supplied) declared dimensions, without
+reconciling the two. A crafted file could therefore cause a write past
+the end of the buffer. The only guard was an assertion, which is a
+no-op in release builds.
+
+Clamp the read to the frame buffer capacity, skip any remaining chunk
+bytes so the file position stays aligned, and remove the reliance on
+the assertion for validating a file-supplied length.
+
+Ref: GHSA-6p2p-5wf8-h5hr
+(cherry picked from commit 7ecc6584969a923c4190b6912afbf5952b5a4b9f)
+
+CVE: CVE-2026-77396
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/7ecc6584969a923c4190b6912afbf5952b5a4b9f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjmedia/src/pjmedia/avi_player.c | 34 +++++++++++++++++++++++++++++---
+ 1 file changed, 31 insertions(+), 3 deletions(-)
+
+diff --git a/pjmedia/src/pjmedia/avi_player.c b/pjmedia/src/pjmedia/avi_player.c
+index dc87b8a41..8b4b94d16 100644
+--- a/pjmedia/src/pjmedia/avi_player.c
++++ b/pjmedia/src/pjmedia/avi_player.c
+@@ -1199,12 +1199,40 @@ static pj_status_t avi_get_frame(pjmedia_port *this_port,
+ goto on_error2;
+ fport->size_left -= size_to_read;
+ } else {
+- pj_assert(frame->size >= ch.len);
+- status = file_read3(fport->fd, frame->buf, ch.len,
++ pj_uint32_t read_len = ch.len;
++
++ /* Clamp the read to the frame buffer capacity. A crafted
++ * file may declare a chunk larger than the buffer, whose
++ * size is derived from the (also file-supplied) video
++ * dimensions; never write past frame->buf (frame->size
++ * bytes). Do not rely on pj_assert() here, as it is a no-op
++ * in release builds.
++ */
++ if (read_len > frame->size) {
++ PJ_LOG(3, (THIS_FILE,
++ "AVI video chunk (%u) exceeds frame buffer "
++ "(%u), truncating",
++ (unsigned)ch.len, (unsigned)frame->size));
++ read_len = (pj_uint32_t)frame->size;
++ }
++
++ status = file_read3(fport->fd, frame->buf, read_len,
+ 0, &size_read);
+ if (status != PJ_SUCCESS)
+ goto on_error2;
+- frame->size = ch.len;
++
++ /* Skip any remaining chunk bytes that did not fit, so the
++ * file position stays aligned to the next chunk.
++ */
++ if (ch.len > read_len) {
++ status = pj_file_setpos(fport->fd,
++ (pj_off_t)ch.len - read_len,
++ PJ_SEEK_CUR);
++ if (status != PJ_SUCCESS)
++ goto on_error2;
++ }
++
++ frame->size = read_len;
+ fport->size_left = 0;
+ }
+
@@ -21,6 +21,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57164.patch \
file://CVE-2026-57165.patch \
file://CVE-2026-57166.patch \
+ file://CVE-2026-77396.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"