From 62bdecb9a6257aa443e06109e3da7faa2fa25411 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Tue, 20 Oct 2026 07:33:56 +1300 Subject: [PATCH] pjproject: patch CVE-2026-77396 Details: https://nvd.nist.gov/vuln/detail/cve-2026-77396 (cherry picked from commit 2f70c43972c254d1a949dd347f81c412bda92446) Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj --- .../pjproject/pjproject/CVE-2026-77396.patch | 74 +++++++++++++++++++ .../pjproject/pjproject_2.17.bb | 1 + 2 files changed, 75 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch new file mode 100644 index 0000000000..a02268bf11 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch @@ -0,0 +1,74 @@ +From a927a964d462e9966864b7b2c432942b61038d6b Mon Sep 17 00:00:00 2001 +From: Nanang Izzuddin +Date: Mon, 13 Jul 2026 09:27:02 +0700 +Subject: [PATCH] Merge commit from fork + +The AVI player used a chunk length taken from the input file as the +number of bytes to read into the video frame buffer, whose capacity is +derived from the (also file-supplied) declared dimensions, without +reconciling the two. A crafted file could therefore cause a write past +the end of the buffer. The only guard was an assertion, which is a +no-op in release builds. + +Clamp the read to the frame buffer capacity, skip any remaining chunk +bytes so the file position stays aligned, and remove the reliance on +the assertion for validating a file-supplied length. + +Ref: GHSA-6p2p-5wf8-h5hr +(cherry picked from commit 7ecc6584969a923c4190b6912afbf5952b5a4b9f) + +CVE: CVE-2026-77396 +Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/7ecc6584969a923c4190b6912afbf5952b5a4b9f] +Signed-off-by: Ankur Tyagi +--- + pjmedia/src/pjmedia/avi_player.c | 34 +++++++++++++++++++++++++++++--- + 1 file changed, 31 insertions(+), 3 deletions(-) + +diff --git a/pjmedia/src/pjmedia/avi_player.c b/pjmedia/src/pjmedia/avi_player.c +index dc87b8a41..8b4b94d16 100644 +--- a/pjmedia/src/pjmedia/avi_player.c ++++ b/pjmedia/src/pjmedia/avi_player.c +@@ -1199,12 +1199,40 @@ static pj_status_t avi_get_frame(pjmedia_port *this_port, + goto on_error2; + fport->size_left -= size_to_read; + } else { +- pj_assert(frame->size >= ch.len); +- status = file_read3(fport->fd, frame->buf, ch.len, ++ pj_uint32_t read_len = ch.len; ++ ++ /* Clamp the read to the frame buffer capacity. A crafted ++ * file may declare a chunk larger than the buffer, whose ++ * size is derived from the (also file-supplied) video ++ * dimensions; never write past frame->buf (frame->size ++ * bytes). Do not rely on pj_assert() here, as it is a no-op ++ * in release builds. ++ */ ++ if (read_len > frame->size) { ++ PJ_LOG(3, (THIS_FILE, ++ "AVI video chunk (%u) exceeds frame buffer " ++ "(%u), truncating", ++ (unsigned)ch.len, (unsigned)frame->size)); ++ read_len = (pj_uint32_t)frame->size; ++ } ++ ++ status = file_read3(fport->fd, frame->buf, read_len, + 0, &size_read); + if (status != PJ_SUCCESS) + goto on_error2; +- frame->size = ch.len; ++ ++ /* Skip any remaining chunk bytes that did not fit, so the ++ * file position stays aligned to the next chunk. ++ */ ++ if (ch.len > read_len) { ++ status = pj_file_setpos(fport->fd, ++ (pj_off_t)ch.len - read_len, ++ PJ_SEEK_CUR); ++ if (status != PJ_SUCCESS) ++ goto on_error2; ++ } ++ ++ frame->size = read_len; + fport->size_left = 0; + } + diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb index 9d1e6af253..89763b3011 100644 --- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb +++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb @@ -21,6 +21,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag file://CVE-2026-57164.patch \ file://CVE-2026-57165.patch \ file://CVE-2026-57166.patch \ + file://CVE-2026-77396.patch \ " SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"