new file mode 100644
@@ -0,0 +1,87 @@
+From f00f023079d0f9a74477da47056bfce76374b2a7 Mon Sep 17 00:00:00 2001
+From: sauwming <ming@teluu.com>
+Date: Fri, 17 Jul 2026 16:46:33 +0800
+Subject: [PATCH] Merge commit from fork
+
+SubjectAltName entries from the OpenSSL and GnuTLS backends were copied
+with pj_strdup2(), which re-derives the length with strlen() and thus
+discards the length already returned by ASN1_STRING_to_UTF8() /
+gnutls_x509_crt_get_subject_alt_name(). A DNS SAN such as
+"victim.example\0.attacker" was therefore truncated to "victim.example".
+
+sip_transport_tls.c disables socket-layer verification and performs its
+own length-aware identity match against subj_alt_name, so the truncated
+prefix compared equal to the target host and a crafted certificate was
+accepted for the prefix hostname (server identity / hostname verification
+bypass; OpenSSL's own X509_check_host() rejects the same certificate).
+
+Copy the SAN using its explicit length via pj_strset()/pj_strdup_with_null()
+so embedded NULs are preserved and no longer truncated. The mbedTLS backend
+already copied with a length-bearing pj_str_t and was not affected.
+
+Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
+(cherry picked from commit 43d3bd77bb6833eab4c493503b8d564a754ddfdd)
+
+CVE: CVE-2026-84975
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib/src/pj/ssl_sock_gtls.c | 17 +++++++++++++++--
+ pjlib/src/pj/ssl_sock_ossl.c | 14 +++++++++++---
+ 2 files changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/pjlib/src/pj/ssl_sock_gtls.c b/pjlib/src/pj/ssl_sock_gtls.c
+index 68ceea3f3..ee977116b 100644
+--- a/pjlib/src/pj/ssl_sock_gtls.c
++++ b/pjlib/src/pj/ssl_sock_gtls.c
+@@ -1072,9 +1072,22 @@ static void tls_cert_get_info(pj_pool_t *pool, pj_ssl_cert_info *ci,
+
+ if (len && type != PJ_SSL_CERT_NAME_UNKNOWN) {
+ ci->subj_alt_name.entry[ci->subj_alt_name.cnt].type = type;
+- pj_strdup2(pool,
++ if (type == PJ_SSL_CERT_NAME_IP) {
++ pj_strdup2(pool,
+ &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+- type == PJ_SSL_CERT_NAME_IP ? buf : out);
++ buf);
++ } else {
++ /* Preserve the reported length instead of using strlen(),
++ * so a DNS SAN containing an embedded NUL is not truncated
++ * at the NUL (which would allow a crafted cert to be
++ * accepted for the prefix hostname; identity bypass).
++ */
++ pj_str_t tmp;
++ pj_strset(&tmp, out, len);
++ pj_strdup_with_null(pool,
++ &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
++ &tmp);
++ }
+ ci->subj_alt_name.cnt++;
+ }
+ }
+diff --git a/pjlib/src/pj/ssl_sock_ossl.c b/pjlib/src/pj/ssl_sock_ossl.c
+index 30b4eeaee..ceb6bca5b 100644
+--- a/pjlib/src/pj/ssl_sock_ossl.c
++++ b/pjlib/src/pj/ssl_sock_ossl.c
+@@ -2270,9 +2270,17 @@ static void get_cert_info(pj_pool_t *pool, pj_ssl_cert_info *ci, X509 *x,
+ &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+ buf);
+ } else {
+- pj_strdup2(pool,
+- &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+- (char*)p);
++ /* Preserve the explicit ASN.1 string length instead of
++ * treating the data as a NUL-terminated C string. A DNS
++ * SAN such as "host.example\0.attacker" would otherwise be
++ * truncated at the embedded NUL, letting a crafted cert be
++ * accepted for the prefix hostname (identity bypass).
++ */
++ pj_str_t tmp;
++ pj_strset(&tmp, (char*)p, len);
++ pj_strdup_with_null(pool,
++ &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
++ &tmp);
+ OPENSSL_free(p);
+ }
+ ci->subj_alt_name.cnt++;
@@ -22,6 +22,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57165.patch \
file://CVE-2026-57166.patch \
file://CVE-2026-77396.patch \
+ file://CVE-2026-84975.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"