mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-20 19:58:34 +00:00
Code Issues Projects Releases Wiki Activity

pjproject: patch CVE-2026-57164

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57164

(cherry picked from commit 274e935099c034192a6815a660b6e8ce0ea9ab92)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Khem Raj committed 2026-10-19 15:08:25 -07:00
1 parent 79c6fa05ca
commit ad9e7732e6
2 files changed
+67
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch
+66
View File
@@ -0,0 +1,66 @@
From 1160ff3c15cfa79f50d4bc6ce8066854f656066c Mon Sep 17 00:00:00 2001
From: Nanang Izzuddin <nanang@teluu.com>
Date: Wed, 17 Jun 2026 15:46:48 +0700
Subject: [PATCH] Merge commit from fork
http_on_data_read() in http_client.c grew the response buffer by a
single doubling, which is insufficient when the server sends a body
larger than twice the (attacker-supplied) Content-Length used for the
initial allocation. Loop the doubling until the buffer fits, with a
floor for the size==0 case to avoid an infinite loop.
Co-Authored-By Claude Code
(cherry picked from commit 8d5956afab2ede95ddb199078dc19a8ac0114f3d)
CVE: CVE-2026-57164
Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/8d5956afab2ede95ddb199078dc19a8ac0114f3d]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
pjlib-util/src/pjlib-util/http_client.c | 27 ++++++++++++++++++-------
1 file changed, 20 insertions(+), 7 deletions(-)
diff --git a/pjlib-util/src/pjlib-util/http_client.c b/pjlib-util/src/pjlib-util/http_client.c
index bd441acb9..d2771d240 100644
--- a/pjlib-util/src/pjlib-util/http_client.c
+++ b/pjlib-util/src/pjlib-util/http_client.c
@@ -432,18 +432,31 @@ static pj_bool_t http_on_data_read(pj_activesock_t *asock,
hreq->response.size);
}
- /* If the size of data received exceeds its current size,
- * grow the buffer by a factor of 2.
+ /* If the size of data received exceeds its current size, grow the
+ * buffer by a factor of 2 repeatedly, until it can actually hold
+ * everything received so far. A single doubling is not sufficient
+ * when the server delivers a body chunk larger than twice the
+ * (possibly undersized) Content-Length used for the initial
+ * allocation, which would otherwise overflow the buffer in the
+ * pj_memcpy() below.
*/
- if (hreq->tcp_state.current_read_size + size >
- hreq->response.size)
+ if (hreq->tcp_state.current_read_size + size >
+ hreq->response.size)
{
void *olddata = hreq->response.data;
+ pj_size_t new_size = hreq->response.size;
- hreq->response.data = pj_pool_alloc(hreq->pool,
- hreq->response.size << 1);
+ /* Guard against size==0 (Content-Length: 0 with a body), which
+ * would make the doubling loop below spin forever.
+ */
+ if (new_size == 0)
+ new_size = INITIAL_DATA_BUF_SIZE;
+ while (hreq->tcp_state.current_read_size + size > new_size)
+ new_size <<= 1;
+
+ hreq->response.data = pj_pool_alloc(hreq->pool, new_size);
pj_memcpy(hreq->response.data, olddata, hreq->response.size);
- hreq->response.size <<= 1;
+ hreq->response.size = new_size;
}
/* Append the response data. */
meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+1
View File
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57161.patch \
file://CVE-2026-57162.patch \
file://CVE-2026-57163.patch \
file://CVE-2026-57164.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"