From ad9e7732e60e25fcda86386519b686e1898540fd Mon Sep 17 00:00:00 2001
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Date: Tue, 20 Oct 2026 07:33:53 +1300
Subject: [PATCH] pjproject: patch CVE-2026-57164

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57164

(cherry picked from commit 274e935099c034192a6815a660b6e8ce0ea9ab92)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
---
 .../pjproject/pjproject/CVE-2026-57164.patch  | 66 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 67 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch
new file mode 100644
index 0000000000..0686d681c3
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch
@@ -0,0 +1,66 @@
+From 1160ff3c15cfa79f50d4bc6ce8066854f656066c Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:46:48 +0700
+Subject: [PATCH] Merge commit from fork
+
+http_on_data_read() in http_client.c grew the response buffer by a
+single doubling, which is insufficient when the server sends a body
+larger than twice the (attacker-supplied) Content-Length used for the
+initial allocation. Loop the doubling until the buffer fits, with a
+floor for the size==0 case to avoid an infinite loop.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit 8d5956afab2ede95ddb199078dc19a8ac0114f3d)
+
+CVE: CVE-2026-57164
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/8d5956afab2ede95ddb199078dc19a8ac0114f3d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib-util/src/pjlib-util/http_client.c | 27 ++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/pjlib-util/src/pjlib-util/http_client.c b/pjlib-util/src/pjlib-util/http_client.c
+index bd441acb9..d2771d240 100644
+--- a/pjlib-util/src/pjlib-util/http_client.c
++++ b/pjlib-util/src/pjlib-util/http_client.c
+@@ -432,18 +432,31 @@ static pj_bool_t http_on_data_read(pj_activesock_t *asock,
+                                                 hreq->response.size);
+         }
+ 
+-        /* If the size of data received exceeds its current size,
+-         * grow the buffer by a factor of 2.
++        /* If the size of data received exceeds its current size, grow the
++         * buffer by a factor of 2 repeatedly, until it can actually hold
++         * everything received so far. A single doubling is not sufficient
++         * when the server delivers a body chunk larger than twice the
++         * (possibly undersized) Content-Length used for the initial
++         * allocation, which would otherwise overflow the buffer in the
++         * pj_memcpy() below.
+          */
+-        if (hreq->tcp_state.current_read_size + size > 
+-            hreq->response.size) 
++        if (hreq->tcp_state.current_read_size + size >
++            hreq->response.size)
+         {
+             void *olddata = hreq->response.data;
++            pj_size_t new_size = hreq->response.size;
+ 
+-            hreq->response.data = pj_pool_alloc(hreq->pool, 
+-                                                hreq->response.size << 1);
++            /* Guard against size==0 (Content-Length: 0 with a body), which
++             * would make the doubling loop below spin forever.
++             */
++            if (new_size == 0)
++                new_size = INITIAL_DATA_BUF_SIZE;
++            while (hreq->tcp_state.current_read_size + size > new_size)
++                new_size <<= 1;
++
++            hreq->response.data = pj_pool_alloc(hreq->pool, new_size);
+             pj_memcpy(hreq->response.data, olddata, hreq->response.size);
+-            hreq->response.size <<= 1;
++            hreq->response.size = new_size;
+         }
+ 
+         /* Append the response data. */
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index de8c847271..8e0b358ffe 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57161.patch \
            file://CVE-2026-57162.patch \
            file://CVE-2026-57163.patch \
+           file://CVE-2026-57164.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"