[rpms/asterisk] f45: Fix for CVE-2026-57160

[rpms/asterisk] f45: Fix for CVE-2026-57160

[Peter Lemenkov]

            A new commit has been pushed.

            Repo   : rpms/asterisk
            Branch : f45
            Commit : 80abf68d0ec4ca7f1d7bf0ab685ea73d9384c142
            Author : Peter Lemenkov <lemenkov@gmail.com>
            Date   : 2026-09-11T22:06:14+02:00
            Stats  : +39/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/asterisk/c/80abf68d0ec4ca7f1d7bf0ab685ea73d9384c142?branch=f45

            Log:
            Fix for CVE-2026-57160

Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>

---
diff --git a/0031-Merge-commit-from-fork.patch b/0031-Merge-commit-from-fork.patch
new file mode 100644
index 0000000..6cd7477
--- /dev/null
+++ b/0031-Merge-commit-from-fork.patch
@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:43:46 +0700
+Subject: [PATCH] Merge commit from fork
+
+When printing a generic array header (e.g. Allow, Require, Supported,
+Unsupported), the ": " delimiter following the header name was written
+with two unchecked stores. copy_advance() only guarantees that the
+header name itself fits, leaving as little as one byte before the end
+of the buffer. The colon then consumed the last byte and the trailing
+space was written one byte past the buffer end.
+
+Use copy_advance_char_check() for both delimiter bytes, matching the
+boundary-checked pattern already used by every other header printer in
+this file.
+
+Co-Authored-By Claude Code
+
+diff --git a/pjsip/src/pjsip/sip_msg.c b/pjsip/src/pjsip/sip_msg.c
+index 06c8cce86..cdc99ff9e 100644
+--- a/pjsip/src/pjsip/sip_msg.c
++++ b/pjsip/src/pjsip/sip_msg.c
+@@ -964,8 +964,8 @@ static int pjsip_generic_array_hdr_print( pjsip_generic_array_hdr *hdr,
+                             &hdr->sname : &hdr->name;
+ 
+     copy_advance(p, (*hname));
+-    *p++ = ':';
+-    *p++ = ' ';
++    copy_advance_char_check(p, ':');
++    copy_advance_char_check(p, ' ');
+ 
+     if (hdr->count > 0) {
+         unsigned i;

diff --git a/asterisk.spec b/asterisk.spec
index 3679f7c..cbe2d94 100644
--- a/asterisk.spec
+++ b/asterisk.spec
@@ -57,7 +57,7 @@
 Summary:          The Open Source PBX
 Name:             asterisk
 Version:          23.5.0
-Release:          %{?_rc||?_beta:0.}2%{?_rc:.rc%{_rc}}%{?_beta:.beta%{_beta}}%{?dist}.1
+Release:          %{?_rc||?_beta:0.}3%{?_rc:.rc%{_rc}}%{?_beta:.beta%{_beta}}%{?dist}
 # Automatically converted from old format: GPLv2 - review is highly recommended.
 License:          GPL-2.0-only
 URL:              http://www.asterisk.org/
@@ -93,6 +93,7 @@ Source9:          https://github.com/akheron/jansson/releases/download/v%{jansso
 Source10:         https://github.com/benmcollins/libjwt/releases/download/v%{jwt_version}/libjwt-%{jwt_version}.tar.gz
 
 Source99:         0030-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility-5036.patch
+Source100:        0031-Merge-commit-from-fork.patch
 
 %if 0%{?fedora} || 0%{?rhel} >=7
 Patch1:           asterisk-16.1.0-explicit-python3.patch
@@ -657,6 +658,7 @@ echo '*************************************************************************'
 %patch -P4 -p1
 
 cp %{S:99} ./third-party/pjproject/patches
+cp %{S:100} ./third-party/pjproject/patches
 
 # Fixup makefile so sound archives aren't downloaded/installed
 %{__perl} -pi -e 's/^all:.*$/all:/' sounds/Makefile
@@ -1650,6 +1652,9 @@ fi
 %endif
 
 %changelog
+* Fri Sep 11 2026 Peter Lemenkov <lemenkov@gmail.com> - 23.5.0-3
+- Fix for CVE-2026-57160
+
 * Thu Sep 10 2026 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 23.5.0-2.1
 - Rebuilt for libxml-2.5.4