diff mbox series

[meta-multimedia,6/20] pjproject: patch CVE-2026-57163

Message ID 20261019183407.1037972-6-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-webserver,1/20] netdata: mark CVE-2026-83602 fixed | expand

Commit Message

Ankur Tyagi Oct. 19, 2026, 6:33 p.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57163

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
(cherry picked from commit 3cc8b60359265c8c6a34242f6c9eb8c3b3c50108)
---
 .../pjproject/pjproject/CVE-2026-57163.patch  | 52 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 53 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch
diff mbox series

Patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch
new file mode 100644
index 0000000000..7b3c681cb9
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch
@@ -0,0 +1,52 @@ 
+From 2276d5ff1fe185a6bb51ab741dd5d88e45dbaa47 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:46:16 +0700
+Subject: [PATCH] Merge commit from fork
+
+The SAN-counting loop in tls_cert_get_info() (ssl_sock_gtls.c) called
+gnutls_x509_crt_get_subject_alt_name() with len still holding
+sizeof(buf) (512) from an earlier getter, while the output buffer is
+only 256 bytes, so an oversized SAN entry overflowed the stack. Set len
+to the true capacity (sizeof(out) - 1, matching the populate loop) on
+every iteration.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit c4a151af86fadd16d9480b2603eeb2abf4fb4f78)
+
+CVE: CVE-2026-57163
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib/src/pj/ssl_sock_gtls.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/pjlib/src/pj/ssl_sock_gtls.c b/pjlib/src/pj/ssl_sock_gtls.c
+index de3d5e99e..68ceea3f3 100644
+--- a/pjlib/src/pj/ssl_sock_gtls.c
++++ b/pjlib/src/pj/ssl_sock_gtls.c
+@@ -1018,12 +1018,22 @@ static void tls_cert_get_info(pj_pool_t *pool, pj_ssl_cert_info *ci,
+     if (ci->version >= 3) {
+         char out[256] = { 0 };
+         /* Get the number of all alternate names so that we can allocate
+-         * the correct number of bytes in subj_alt_name */
++         * the correct number of bytes in subj_alt_name.
++         *
++         * Pass the true capacity of 'out' as the in/out size argument on
++         * every iteration. 'len' otherwise still holds sizeof(buf) (512)
++         * from an earlier getter, which would let GnuTLS copy an oversized
++         * SubjectAltName entry past the end of the 256-byte 'out' buffer.
++         * Use sizeof(out) - 1 to match the populate loop below, leaving
++         * room for the NUL terminator GnuTLS appends to string names.
++         */
++        len = sizeof(out) - 1;
+         while (gnutls_x509_crt_get_subject_alt_name(cert, seq, out, &len,
+                                                     NULL) !=
+                GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+         {
+             seq++;
++            len = sizeof(out) - 1;
+         }
+ 
+         ci->subj_alt_name.entry = pj_pool_calloc(pool, seq,
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index f47d661400..de8c847271 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -17,6 +17,7 @@  SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57160.patch \
            file://CVE-2026-57161.patch \
            file://CVE-2026-57162.patch \
+           file://CVE-2026-57163.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"