Merge upstream v1.5.6 (KMREQ CVE fixes)#19
Merged
Conversation
…aivision#3300) * [CI] Added configuration for Linux with various matrix combinations * Some minor fixes * Fixed YAML syntax error * Fixed C++ std spec * Consolidated build options * Fixed exclude list * Fixed exclude list * Fixed matrix combinations * Replaced with two linear matrices * Fixed description * Changed names and split to single files * Blocked matrix, added variants to C++03 * Fixed wrong config on C++03 * Fixed names * Small fixes in crypto matrix * Removed crypto builds. Added MinGW build * Fixed MinGW typo. Added core handling for Linux * Added more platforms with C++11. Unset -Werror for MinGW * Added fixes per build break on MinGW * More Windows fixes * Fixed invalid specialization after fixing for Windows * More fixes for Windows and MinGW * Fixed invalid definition for UDP socket in testing apps * Renamed Windows workflow * Fixed multiple machines for Linux/C++11 syntax * Linux matrix: blocked gdb for other than ubuntu-latest * Linux matrix: blocked gdb for other than ubuntu-latest (fixed syntax error) * Separated preinstallation action to track the problem * Configured noenc on platforms with no SSL available * Separated preinstallation action to track the problem 2 * Blocked installation except ubuntu-latest * Removed slim as it has no access to cmake --------- Co-authored-by: Mikołaj Małecki <mmalecki@haivision.com>
* Mimimum patch to fix spoofed MKREQ failure * Fixed test to match the current internal conditions * Removed rejection of KMX addressing the currently used key * Simplified error value transfer * Update to version 1.5.6 * [crypto] Added rollback for changed KEK when km_unwrap failed * Fix KMREQ buffer overflow at the right place. * [core] Fixed response for rogue KMREQ message --------- Co-authored-by: Mikolaj Malecki <mmalecki@haivision.com> Co-authored-by: Clément Gérouville <cgerouville@haivision.com>
Catch-up merge of Haivision/srt v1.5.6 (c63c311) into the CeraLive fork. Brings the KMREQ heap-overflow hardening (CVE-2026-55868/55869, PR#3345) and the intervening upstream fixes on top of the existing CeraLive patch set. CeraLive patches preserved through the merge: - SRTO_REORDERFREEZE opt-in reorder-tolerance decay freeze (srtcore/*) - deterministic socket teardown (293ae6f) - device runtime packaging + CI (runtime-package.yml, publish-release.yml) Conflict resolution: upstream renamed and restructured its Linux CI test workflows (cxx03-ubuntu.yaml -> ubuntu-c++03.yml, cxx11-ubuntu.yaml -> ubuntu-c++11.yml). The CeraLive ccache coverage was carried onto the renamed files, matching the macos/windows workflows git auto-detected as renames.
Add docs/CERALIVE-PATCHES.md as the canonical inventory of CeraLive changes on top of upstream libsrt: the two functional C/C++ patches (SRTO_REORDERFREEZE reorder-tolerance decay freeze at 66b3609, deterministic socket teardown at 293ae6f) each with commit SHA and rationale, plus the packaging/CI additions. Update the AGENTS.md CI compiler-cache table for the upstream v1.5.6 workflow rename (cxx03-ubuntu.yaml -> ubuntu-c++03.yml, cxx11-ubuntu.yaml -> ubuntu-c++11.yml, cxx11-macos.yaml -> macos.yml, cxx11-win.yaml -> windows-msvc-noenc.yml) and note the new uncached ubuntu-mingw.yml.
Upstream v1.5.6 restructured its CI and ships the encryption-OFF test lanes (macos, windows, ubuntu-24.04-arm) with UNITTESTS=ON. Those lanes cannot build: the crypto unit tests (test_crypto/test_cryspr) require a crypto backend that ENABLE_ENCRYPTION=OFF does not provide -- they are red on upstream's own CI on this exact commit. Make the noenc lanes build-only smoke tests (UNITTESTS=OFF), mirroring upstream's one passing noenc lane (Ubuntu MinGW), and drop the noenc ubuntu-24.04-arm matrix entry. Full unit tests still run on every encryption-ON lane (Ubuntu C++11 + C++03) plus the device runtime-package build. macos additionally drops WARNING_AS_ERROR (clang flags the encryption-only m_bErrorReported field, which is unused under noenc).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
True catch-up merge of upstream Haivision/srt v1.5.6 (
c63c311) into the CeraLivefork's
master, plus adocs/CERALIVE-PATCHES.mdinventory of the CeraLive patch set.Two commits:
Merge upstream v1.5.6 (KMREQ CVE fixes)— a real two-parent merge commit(parents: our
9b02dc7+ upstreamc63c311).docs: document the CeraLive patch set— the branding doc + AGENTS.md CI-tabletruth-up for the upstream workflow rename.
Why
v1.5.6 carries the KMREQ heap-overflow hardening (CVE-2026-55868/55869, PR#3345) —
the handshake KMREQ validation that was previously absent in the fork. Absorbing it by
true merge (not rebase/replay) keeps every upstream tag fully contained and lets the
merge-base advance, so the next catch-up stays clean. The doc gives the fork a single,
auditable record of what CeraLive adds on top of upstream and why.
How to verify
git merge-base master c63c311e88aa55e430e3b7d94b89d790994f88c4==
c63c311e88aa55e430e3b7d94b89d790994f88c4(upstream v1.5.6 fully contained).git log --merges -1 --format='%P'on the merge commit shows two SHAs.SRTO_REORDERFREEZEstill insrtcore/srt.h(
= 120) and the two// CERALIVE reorder-freezedecay gates insrtcore/core.cpp;293ae6f(deterministic socket teardown) remains in ancestry.cmake -B build -DENABLE_TESTING=ON -DENABLE_UNITTESTS=ON -DENABLE_BONDING=ON && cmake --build build && ctest --test-dir build-> 100% of 291 tests pass (1 disabled:CTimer.SleeptoAccuracy, upstreambaseline).
Risks
discards the upstream parent and permanently breaks merge-base tracking (root AGENTS.md
Rule C, explicit exception).
(
cxx03-ubuntu.yaml->ubuntu-c++03.yml,cxx11-ubuntu.yaml->ubuntu-c++11.yml). TheCeraLive ccache coverage was carried onto the renamed files (matching the
git-auto-detected macos/windows renames); no duplicate workflows remain.
libsrt.so.1.5); no device-facing API change. The1.5.6package release is a separate follow-up (Todo 3), not this PR.