pjproject: patch CVE-2026-57162

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57162

(cherry picked from commit f7758a033eec4754fdb957a0fb2c6d2d5cb31ea6)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch

@@ -0,0 +1,43 @@
+From 1b64bfb240731bbf0fc194dec68bb9d9b08a20b2 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:45:33 +0700
+Subject: [PATCH] Merge commit from fork
+
+sdes_encode_sdp() in transport_srtp_sdes.c wrote each parsed crypto tag
+into the fixed int tags[64] array without bounding the count, while the
+SDP parser allows up to PJMEDIA_MAX_SDP_ATTR (68) attributes. Reject
+the SDP with PJMEDIA_SRTP_ESDPINCRYPTO once the array capacity is
+reached, before the out-of-bounds write.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9)
+
+CVE: CVE-2026-57162
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjmedia/src/pjmedia/transport_srtp_sdes.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/pjmedia/src/pjmedia/transport_srtp_sdes.c b/pjmedia/src/pjmedia/transport_srtp_sdes.c
+index 8f98292ba..45038e585 100644
+--- a/pjmedia/src/pjmedia/transport_srtp_sdes.c
++++ b/pjmedia/src/pjmedia/transport_srtp_sdes.c
+@@ -478,6 +478,15 @@ static pj_status_t sdes_encode_sdp( pjmedia_transport *tp,
+ 
+                 has_crypto_attr = PJ_TRUE;
+ 
++                /* Bound writes to tags[] by its capacity. m_rem->attr_count
++                 * is capped by the SDP parser at PJMEDIA_MAX_SDP_ATTR, which
++                 * can exceed PJ_ARRAY_SIZE(tags); without this guard a remote
++                 * peer can overflow the stack array by sending more than
++                 * PJ_ARRAY_SIZE(tags) a=crypto attributes.
++                 */
++                if (cr_attr_count >= PJ_ARRAY_SIZE(tags))
++                    return PJMEDIA_SRTP_ESDPINCRYPTO;
++
+                 status = parse_attr_crypto(srtp->pool, m_rem->attr[i],
+                                            &tmp_rx_crypto,
+                                            &tags[cr_attr_count]);

meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb

@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
            file://CVE-2026-57160.patch \
            file://CVE-2026-57161.patch \
+           file://CVE-2026-57162.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"