mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-21 08:08:29 +00:00
Code Issues Projects Releases Wiki Activity

pjproject: patch CVE-2026-77396

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-77396

(cherry picked from commit 2f70c43972c254d1a949dd347f81c412bda92446)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Khem Raj committed 2026-10-19 15:08:25 -07:00
1 parent f1274b1221
commit 62bdecb9a6
2 files changed
+75
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch
+74
View File
@@ -0,0 +1,74 @@
From a927a964d462e9966864b7b2c432942b61038d6b Mon Sep 17 00:00:00 2001
From: Nanang Izzuddin <nanang@teluu.com>
Date: Mon, 13 Jul 2026 09:27:02 +0700
Subject: [PATCH] Merge commit from fork
The AVI player used a chunk length taken from the input file as the
number of bytes to read into the video frame buffer, whose capacity is
derived from the (also file-supplied) declared dimensions, without
reconciling the two. A crafted file could therefore cause a write past
the end of the buffer. The only guard was an assertion, which is a
no-op in release builds.
Clamp the read to the frame buffer capacity, skip any remaining chunk
bytes so the file position stays aligned, and remove the reliance on
the assertion for validating a file-supplied length.
Ref: GHSA-6p2p-5wf8-h5hr
(cherry picked from commit 7ecc6584969a923c4190b6912afbf5952b5a4b9f)
CVE: CVE-2026-77396
Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/7ecc6584969a923c4190b6912afbf5952b5a4b9f]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
pjmedia/src/pjmedia/avi_player.c | 34 +++++++++++++++++++++++++++++---
1 file changed, 31 insertions(+), 3 deletions(-)
diff --git a/pjmedia/src/pjmedia/avi_player.c b/pjmedia/src/pjmedia/avi_player.c
index dc87b8a41..8b4b94d16 100644
--- a/pjmedia/src/pjmedia/avi_player.c
+++ b/pjmedia/src/pjmedia/avi_player.c
@@ -1199,12 +1199,40 @@ static pj_status_t avi_get_frame(pjmedia_port *this_port,
goto on_error2;
fport->size_left -= size_to_read;
} else {
- pj_assert(frame->size >= ch.len);
- status = file_read3(fport->fd, frame->buf, ch.len,
+ pj_uint32_t read_len = ch.len;
+
+ /* Clamp the read to the frame buffer capacity. A crafted
+ * file may declare a chunk larger than the buffer, whose
+ * size is derived from the (also file-supplied) video
+ * dimensions; never write past frame->buf (frame->size
+ * bytes). Do not rely on pj_assert() here, as it is a no-op
+ * in release builds.
+ */
+ if (read_len > frame->size) {
+ PJ_LOG(3, (THIS_FILE,
+ "AVI video chunk (%u) exceeds frame buffer "
+ "(%u), truncating",
+ (unsigned)ch.len, (unsigned)frame->size));
+ read_len = (pj_uint32_t)frame->size;
+ }
+
+ status = file_read3(fport->fd, frame->buf, read_len,
0, &size_read);
if (status != PJ_SUCCESS)
goto on_error2;
- frame->size = ch.len;
+
+ /* Skip any remaining chunk bytes that did not fit, so the
+ * file position stays aligned to the next chunk.
+ */
+ if (ch.len > read_len) {
+ status = pj_file_setpos(fport->fd,
+ (pj_off_t)ch.len - read_len,
+ PJ_SEEK_CUR);
+ if (status != PJ_SUCCESS)
+ goto on_error2;
+ }
+
+ frame->size = read_len;
fport->size_left = 0;
}
meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+1
View File
@@ -21,6 +21,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57164.patch \
file://CVE-2026-57165.patch \
file://CVE-2026-57166.patch \
file://CVE-2026-77396.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"