pjproject: patch CVE-2026-57163

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57163

(cherry picked from commit 3cc8b60359265c8c6a34242f6c9eb8c3b3c50108)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch

@@ -0,0 +1,52 @@
+From 2276d5ff1fe185a6bb51ab741dd5d88e45dbaa47 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:46:16 +0700
+Subject: [PATCH] Merge commit from fork
+
+The SAN-counting loop in tls_cert_get_info() (ssl_sock_gtls.c) called
+gnutls_x509_crt_get_subject_alt_name() with len still holding
+sizeof(buf) (512) from an earlier getter, while the output buffer is
+only 256 bytes, so an oversized SAN entry overflowed the stack. Set len
+to the true capacity (sizeof(out) - 1, matching the populate loop) on
+every iteration.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit c4a151af86fadd16d9480b2603eeb2abf4fb4f78)
+
+CVE: CVE-2026-57163
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib/src/pj/ssl_sock_gtls.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/pjlib/src/pj/ssl_sock_gtls.c b/pjlib/src/pj/ssl_sock_gtls.c
+index de3d5e99e..68ceea3f3 100644
+--- a/pjlib/src/pj/ssl_sock_gtls.c
++++ b/pjlib/src/pj/ssl_sock_gtls.c
+@@ -1018,12 +1018,22 @@ static void tls_cert_get_info(pj_pool_t *pool, pj_ssl_cert_info *ci,
+     if (ci->version >= 3) {
+         char out[256] = { 0 };
+         /* Get the number of all alternate names so that we can allocate
+-         * the correct number of bytes in subj_alt_name */
++         * the correct number of bytes in subj_alt_name.
++         *
++         * Pass the true capacity of 'out' as the in/out size argument on
++         * every iteration. 'len' otherwise still holds sizeof(buf) (512)
++         * from an earlier getter, which would let GnuTLS copy an oversized
++         * SubjectAltName entry past the end of the 256-byte 'out' buffer.
++         * Use sizeof(out) - 1 to match the populate loop below, leaving
++         * room for the NUL terminator GnuTLS appends to string names.
++         */
++        len = sizeof(out) - 1;
+         while (gnutls_x509_crt_get_subject_alt_name(cert, seq, out, &len,
+                                                     NULL) !=
+                GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+         {
+             seq++;
++            len = sizeof(out) - 1;
+         }
+ 
+         ci->subj_alt_name.entry = pj_pool_calloc(pool, seq,

meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb

@@ -17,6 +17,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57160.patch \
            file://CVE-2026-57161.patch \
            file://CVE-2026-57162.patch \
+           file://CVE-2026-57163.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"