Claude: Upgrade libsrt from 1.5.3 to 1.5.6 for CVE-2026-55868/55869.

Replace the vendored srt-1-fit tree with upstream SRT v1.5.6 to pick up
two remotely reachable security fixes and three hardening changes:

- CVE-2026-55869 (upstream PR #3317): processSrtMsg_KMREQ copied bytelen/4
  words into a 104-byte stack buffer with no capacity check.
- CVE-2026-55868 (upstream PR #3319): processSrtMsg_KMRSP did the same with
  no validation of len at all.
- Upstream PR #3324, #3320, #3322: OOB reads in LOSSREPORT range parsing and
  DROPREQ payload parsing, plus a CRcvBuffer::dropMessage range guard.

Both CVEs were reachable against a default SRS build with srt_server enabled.
The enforced-encryption gate in interpretSrtHandshake blocks the handshake
path when no passphrase is configured, but the post-connect UMSG_EXT control
packet path (CUDT::processSrtMsg) has no such gate and needs no passphrase,
so a peer that completes a handshake could overflow the stack buffer by about
1352 bytes. SRT is off by default at runtime, so only deployments that
explicitly enable srt_server were exposed.

The fit tree was a pure subset of upstream 1.5.3 with no local edits, so 1.5.6
is vendored the same way: apps, tests, docs, examples, CI files, and the new
submodules directory are pruned, everything else is pristine upstream.

Retarget patches/srt/api.cpp-01.patch from line 1116 to 1312. The old number
was already stale for 1.5.3, where the line sat at 1133 and patch located it
by content.

Update trunk/3rdparty/README.md and the C++ server code map for the new
version, the new Botan crypto backend, and the fit's provenance.

Verified: configure builds libsrt reporting SRT_VERSION_STRING "1.5.6", the
api.cpp patch applies with no offset, make completes, the srs binary carries
the fixed code, and srt_server binds UDP 10080.

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: winlinvip

skills/internal-codemap-for-srs/references/cpp-server.md

@@ -322,7 +322,7 @@ Non-runtime support:
 
 ## SRT Fit Code
 
-SRT Fit (`trunk/3rdparty/srt-1-fit/`) is the vendored SRT 1.5.3 transport library used by the C++ media server's SRT listener, connections, and source. It builds `libsrt` without the upstream command-line applications and uses OpenSSL through HaiCrypt for payload encryption; the Go server does not use this tree.
+SRT Fit (`trunk/3rdparty/srt-1-fit/`) is the vendored SRT 1.5.6 transport library used by the C++ media server's SRT listener, connections, and source. It builds `libsrt` without the upstream command-line applications and uses OpenSSL through HaiCrypt for payload encryption; the Go server does not use this tree. The tree is pristine upstream source with the apps, tests, docs, examples, and CI files removed; the only SRS-local change is `trunk/3rdparty/patches/srt/api.cpp-01.patch`, applied at build time by `trunk/auto/depends.sh`.
 
 Build and portability:
 - `CMakeLists.txt` — Library version, source selection, crypto backend, build options, targets, and installation
@@ -356,4 +356,4 @@ HaiCrypt (`haicrypt/`):
 - `haicrypt.h`, `hcrypt.c`, `hcrypt_ctx_rx.c`, `hcrypt_ctx_tx.c`, `hcrypt_rx.c`, `hcrypt_tx.c` — Encryption API, key contexts, key rotation, and packet encrypt/decrypt paths
 - `hcrypt_sa.c`, `hcrypt_msg.h`, `hcrypt_xpt_srt.c` — Security associations, key messages, and SRT packet transport adapter
 - `cryspr.c`, `cryspr.h`, `cryspr-openssl*.c` — Crypto-provider abstraction and OpenSSL backends used by the SRS build
-- `cryspr-gnutls.*`, `cryspr-mbedtls.*` — Alternative crypto backends retained from upstream
+- `cryspr-gnutls.*`, `cryspr-mbedtls.*`, `cryspr-botan.*` — Alternative crypto backends retained from upstream

trunk/3rdparty/README.md

@@ -9,8 +9,8 @@ nginx-1.5.7.zip
 * for srs to support hls streaming.
 
 srt-1-fit
-srt-1.5.3.tar.gz
-* https://github.com/Haivision/srt/releases/tag/v1.5.3
+srt-1.5.6.tar.gz
+* https://github.com/Haivision/srt/releases/tag/v1.5.6
 * https://ossrs.net/lts/zh-cn/license#srt
 
 openssl-1.1-fit

trunk/3rdparty/patches/srt/api.cpp-01.patch

@@ -1,4 +1,4 @@
-1116c1116
+1312c1312
 <             LOGC(cnlog.Debug, log << "srt_accept: no pending connection available at the moment");
 ---
 >             LOGC(cnlog.Error, log << "srt_accept: no pending connection available at the moment");