From f5120a46371ff75f401c1cb724c3880811bfbae0 Mon Sep 17 00:00:00 2001 From: Sebastian Kemper Date: Sat, 3 Dec 2022 15:41:32 +0100 Subject: pjproject: bump to 2.12.1 This is a manual cherry-pick of a57228588602e5217b95f1e9ded0b76402cb6c72 and 472f1ac7ac867b8fbc2841c56e7d61935dba9d52. The only difference is that the uclibc-related patches were not dropped, because uclibc is used in OpenWrt 21.02. - add "--disable-android-mediacodec" to configure - add EXCLUDE_APP=1 to "make" calls so some apps aren't built (speeds up the build a bit) - drop "sed" call as no longer needed - update 0004-config_site.patch to sync up with Asterisk 18.14.0 - update 0006-fix-pkg_config-file.patch as there were some changes in this area upstream - add 0007-execinfo.patch to prevent errors due to missing - sync patches with Asterisk 18.14.0 - backports two security fixes (c4d3498 and 450baca) from pjproject 2.13, source: asterisk 20.0.1 Signed-off-by: Sebastian Kemper --- ...low-when-parsing-message-as-a-STUN-client.patch | 39 ++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 libs/pjproject/patches/0201-potential-stack-buffer-overflow-when-parsing-message-as-a-STUN-client.patch (limited to 'libs/pjproject/patches/0201-potential-stack-buffer-overflow-when-parsing-message-as-a-STUN-client.patch') diff --git a/libs/pjproject/patches/0201-potential-stack-buffer-overflow-when-parsing-message-as-a-STUN-client.patch b/libs/pjproject/patches/0201-potential-stack-buffer-overflow-when-parsing-message-as-a-STUN-client.patch new file mode 100644 index 0000000..d66b773 --- /dev/null +++ b/libs/pjproject/patches/0201-potential-stack-buffer-overflow-when-parsing-message-as-a-STUN-client.patch @@ -0,0 +1,39 @@ +From 450baca94f475345542c6953832650c390889202 Mon Sep 17 00:00:00 2001 +From: sauwming +Date: Tue, 7 Jun 2022 12:00:13 +0800 +Subject: [PATCH] Merge pull request from GHSA-26j7-ww69-c4qj + +--- + pjlib-util/src/pjlib-util/stun_simple.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/pjlib-util/src/pjlib-util/stun_simple.c ++++ b/pjlib-util/src/pjlib-util/stun_simple.c +@@ -54,6 +54,7 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( vo + { + pj_uint16_t msg_type, msg_len; + char *p_attr; ++ int attr_max_cnt = PJ_ARRAY_SIZE(msg->attr); + + PJ_CHECK_STACK(); + +@@ -83,7 +84,7 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( vo + msg->attr_count = 0; + p_attr = (char*)buf + sizeof(pjstun_msg_hdr); + +- while (msg_len > 0) { ++ while (msg_len > 0 && msg->attr_count < attr_max_cnt) { + pjstun_attr_hdr **attr = &msg->attr[msg->attr_count]; + pj_uint32_t len; + pj_uint16_t attr_type; +@@ -111,6 +112,10 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( vo + p_attr += len; + ++msg->attr_count; + } ++ if (msg->attr_count == attr_max_cnt) { ++ PJ_LOG(4, (THIS_FILE, "Warning: max number attribute %d reached.", ++ attr_max_cnt)); ++ } + + return PJ_SUCCESS; + } -- cgit