diff mbox series

[meta-multimedia,3/20] pjproject: patch CVE-2026-57160

Message ID 20261019183407.1037972-3-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-webserver,1/20] netdata: mark CVE-2026-83602 fixed | expand

Commit Message

Ankur Tyagi Oct. 19, 2026, 6:33 p.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57160

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
(cherry picked from commit 78f0ee20ccfb85b9cc8477e19bb143110d975962)
---
 .../pjproject/pjproject/CVE-2026-57160.patch  | 42 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 43 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch
diff mbox series

Patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch
new file mode 100644
index 0000000000..a25ed5a28e
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch
@@ -0,0 +1,42 @@ 
+From b14ebbccf5c228ca298ad11ecae2cedde792edae Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:43:46 +0700
+Subject: [PATCH] Merge commit from fork
+
+When printing a generic array header (e.g. Allow, Require, Supported,
+Unsupported), the ": " delimiter following the header name was written
+with two unchecked stores. copy_advance() only guarantees that the
+header name itself fits, leaving as little as one byte before the end
+of the buffer. The colon then consumed the last byte and the trailing
+space was written one byte past the buffer end.
+
+Use copy_advance_char_check() for both delimiter bytes, matching the
+boundary-checked pattern already used by every other header printer in
+this file.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit d6a0e7f76611c3a6f530ee051e3e7a622bb1748c)
+
+CVE: CVE-2026-57160
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/d6a0e7f76611c3a6f530ee051e3e7a622bb1748c]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjsip/src/pjsip/sip_msg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pjsip/src/pjsip/sip_msg.c b/pjsip/src/pjsip/sip_msg.c
+index 06c8cce86..cdc99ff9e 100644
+--- a/pjsip/src/pjsip/sip_msg.c
++++ b/pjsip/src/pjsip/sip_msg.c
+@@ -964,8 +964,8 @@ static int pjsip_generic_array_hdr_print( pjsip_generic_array_hdr *hdr,
+                             &hdr->sname : &hdr->name;
+ 
+     copy_advance(p, (*hname));
+-    *p++ = ':';
+-    *p++ = ' ';
++    copy_advance_char_check(p, ':');
++    copy_advance_char_check(p, ' ');
+ 
+     if (hdr->count > 0) {
+         unsigned i;
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 59684ac7c7..254a2952a2 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -14,6 +14,7 @@  LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 
 SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag=${PV} \
            file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
+           file://CVE-2026-57160.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"