mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-20 19:58:34 +00:00
Code Issues Projects Releases Wiki Activity

pjproject: patch CVE-2026-57161

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57161

(cherry picked from commit 371f20419d88f75dd45508451ec014d1a0c94b70)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Khem Raj committed 2026-10-19 15:08:24 -07:00
1 parent d54112ed60
commit 8e1643c4b6
2 files changed
+50
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch
+49
View File
@@ -0,0 +1,49 @@
From 656cd5ec76f0178448053a9ca44ce075cd7a27f9 Mon Sep 17 00:00:00 2001
From: Nanang Izzuddin <nanang@teluu.com>
Date: Wed, 17 Jun 2026 15:44:40 +0700
Subject: [PATCH] Merge commit from fork
Bound the number of Service-Route URIs stored in the fixed-size uri[]
array by checking uri_cnt against PJ_ARRAY_SIZE(uri) before each write.
Previously the count was only checked as the do/while continuation
condition, which does not catch accumulation across multiple
single-URI Service-Route headers, allowing a registrar response with
more than PJSUA_ACC_MAX_PROXIES headers to write past the array.
Co-Authored-By Claude Code
(cherry picked from commit acc03b57cef7a7d31b8e1f5b9117437d7e87c591)
CVE: CVE-2026-57161
Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/acc03b57cef7a7d31b8e1f5b9117437d7e87c591]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
pjsip/src/pjsua-lib/pjsua_acc.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/pjsip/src/pjsua-lib/pjsua_acc.c b/pjsip/src/pjsua-lib/pjsua_acc.c
index f52518a2a..08c5efced 100644
--- a/pjsip/src/pjsua-lib/pjsua_acc.c
+++ b/pjsip/src/pjsua-lib/pjsua_acc.c
@@ -2278,14 +2278,14 @@ static void update_service_route(pjsua_acc *acc, pjsip_rx_data *rdata)
return;
}
+ if (uri_cnt >= PJ_ARRAY_SIZE(uri)) {
+ PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
+ return;
+ }
+
uri[uri_cnt++] = h->name_addr.uri;
h = h->next;
- } while (h != hr && uri_cnt != PJ_ARRAY_SIZE(uri));
-
- if (h != hr) {
- PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
- return;
- }
+ } while (h != hr);
/* Prepare to find next Service-Route header */
hsr = hsr->next;
meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+1
View File
@@ -15,6 +15,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag=${PV} \
file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
file://CVE-2026-57160.patch \
file://CVE-2026-57161.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"