pjproject: patch CVE-2026-57165

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57165

(cherry picked from commit aac29142ede95bcf48ecf16e19671314feb1590e)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch

@@ -0,0 +1,85 @@
+From 5776ee452296d5277d71e2bb011709adec80a533 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:47:29 +0700
+Subject: [PATCH] Merge commit from fork
+
+handle_up_down() in cli_telnet.c accumulated cur_pos + 2*rcmd->len +
+history->slen bytes into a fixed PJ_CLI_MAX_CMDBUF stack buffer with no
+bound check. Size the buffer for the worst case, clamp each term to
+PJ_CLI_MAX_CMDBUF, and replace the trailing unchecked pj_strcat with a
+bounded pj_memcpy.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit 628b71638465bacf66e767959e6acbab822eccd6)
+
+CVE: CVE-2026-57165
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/628b71638465bacf66e767959e6acbab822eccd6]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib-util/src/pjlib-util/cli_telnet.c | 33 ++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+diff --git a/pjlib-util/src/pjlib-util/cli_telnet.c b/pjlib-util/src/pjlib-util/cli_telnet.c
+index 150727bb5..0a2954bd4 100644
+--- a/pjlib-util/src/pjlib-util/cli_telnet.c
++++ b/pjlib-util/src/pjlib-util/cli_telnet.c
+@@ -1141,7 +1141,14 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+     history = get_prev_history(sess, is_up);
+     if (history) {
+         pj_str_t send_data;
+-        char str[PJ_CLI_MAX_CMDBUF];
++        /* The redraw sequence can accumulate up to
++         *   cur_pos + 2 * rcmd->len + history->slen
++         * bytes, each term bounded by PJ_CLI_MAX_CMDBUF, so size the
++         * local buffer for the worst case and clamp each term below.
++         */
++        char str[PJ_CLI_MAX_CMDBUF * 4];
++        unsigned cur_pos, buf_len;
++        pj_size_t hist_len;
+         enum {
+             MOVE_CURSOR_LEFT = 0x08,
+             CLEAR_CHAR = 0x20
+@@ -1149,15 +1156,24 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+         send_data.ptr = str;
+         send_data.slen = 0;
+ 
++        cur_pos = sess->rcmd->cur_pos;
++        buf_len = sess->rcmd->len;
++        hist_len = history->slen;
++        if (cur_pos > PJ_CLI_MAX_CMDBUF)
++            cur_pos = PJ_CLI_MAX_CMDBUF;
++        if (buf_len > PJ_CLI_MAX_CMDBUF)
++            buf_len = PJ_CLI_MAX_CMDBUF;
++        if (hist_len > PJ_CLI_MAX_CMDBUF)
++            hist_len = PJ_CLI_MAX_CMDBUF;
++
+         /* Move cursor position to the beginning of line */
+-        if (sess->rcmd->cur_pos > 0) {
+-            pj_memset(send_data.ptr, MOVE_CURSOR_LEFT, sess->rcmd->cur_pos);
+-            send_data.slen = sess->rcmd->cur_pos;
++        if (cur_pos > 0) {
++            pj_memset(send_data.ptr, MOVE_CURSOR_LEFT, cur_pos);
++            send_data.slen = cur_pos;
+         }
+ 
+-        if (sess->rcmd->len > (unsigned)history->slen) {
++        if (buf_len > (unsigned)hist_len) {
+             /* Clear the command currently shown*/
+-            unsigned buf_len = sess->rcmd->len;
+             pj_memset(&send_data.ptr[send_data.slen], CLEAR_CHAR, buf_len);
+             send_data.slen += buf_len;
+ 
+@@ -1167,7 +1183,10 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+             send_data.slen += buf_len;
+         }
+         /* Send data */
+-        pj_strcat(&send_data, history);
++        if (hist_len > 0) {
++            pj_memcpy(&send_data.ptr[send_data.slen], history->ptr, hist_len);
++            send_data.slen += hist_len;
++        }
+         telnet_sess_send(sess, &send_data);
+         pj_ansi_strxcpy2((char*)sess->rcmd->rbuf, history, 
+                          sizeof(sess->rcmd->rbuf));

meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb

@@ -19,6 +19,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57162.patch \
            file://CVE-2026-57163.patch \
            file://CVE-2026-57164.patch \
+           file://CVE-2026-57165.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"