Claude: Upgrade libsrt to 1.5.6 for security enhancement. v8.0.29 (#4729)

Upgrade the vendored SRT library from 1.5.3 to 1.5.6 to fix two remotely
reachable security vulnerabilities.

Fixes #4727.

SRS vendored SRT 1.5.3 on all maintained branches. Both CVEs fixed in
upstream 1.5.6 were confirmed reachable in SRS, not merely present by
version number:

- **CVE-2026-55869** (upstream PR #3317) — `processSrtMsg_KMREQ` copied
`bytelen/4` words into a 104-byte stack buffer with no capacity check.
The existing `bytelen <= HCRYPT_MSG_KM_OFS_SALT` test is a lower bound
and runs *after* the copy.
- **CVE-2026-55868** (upstream PR #3319) — `processSrtMsg_KMRSP` did the
same with no validation of `len` at all.

The enforced-encryption gate in `interpretSrtHandshake` blocks the
handshake path when no passphrase is configured, but it does **not**
cover the post-connect `UMSG_EXT` control packet path
(`CUDT::processSrtMsg`), which has no passphrase gate and reaches both
handlers on any established connection. With the default MSS of 1500,
that is roughly **1352 bytes of stack overflow** from any peer that
completes a handshake — and SRS's streamid and callback auth run after
`srt_accept` returns, so they do not gate it.

SRT is off by default at runtime (`get_srt_enabled()` returns false and
stock `conf/srs.conf` has no `srt_server` block), so only deployments
that explicitly enable `srt_server` were exposed.

1.5.6 also carries three hardening changes (upstream PRs #3324, #3320,
out-of-bounds reads land inside the same 1500-byte unit slot allocated
by `CUnitQueue::allocateEntry`, making them stale-data logic bugs rather
than memory-safety violations, and the `CRcvBuffer::dropMessage` guard
is unreachable under SRS defaults because its caller sits behind
`!m_bTLPktDrop || !m_bTsbPd`.

Full reachability analysis:
#4727 (comment)

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: winlinvip

internal/version/version.go

@@ -15,7 +15,7 @@ func VersionMinor() int {
 }
 
 func VersionRevision() int {
-	return 28
+	return 29
 }
 
 func Version() string {

skills/internal-codemap-for-srs/references/cpp-server.md

@@ -322,7 +322,7 @@ Non-runtime support:
 
 ## SRT Fit Code
 
-SRT Fit (`trunk/3rdparty/srt-1-fit/`) is the vendored SRT 1.5.3 transport library used by the C++ media server's SRT listener, connections, and source. It builds `libsrt` without the upstream command-line applications and uses OpenSSL through HaiCrypt for payload encryption; the Go server does not use this tree.
+SRT Fit (`trunk/3rdparty/srt-1-fit/`) is the vendored SRT 1.5.6 transport library used by the C++ media server's SRT listener, connections, and source. It builds `libsrt` without the upstream command-line applications and uses OpenSSL through HaiCrypt for payload encryption; the Go server does not use this tree. The tree is pristine upstream source with the apps, tests, docs, examples, and CI files removed; the only SRS-local change is `trunk/3rdparty/patches/srt/api.cpp-01.patch`, applied at build time by `trunk/auto/depends.sh`.
 
 Build and portability:
 - `CMakeLists.txt` — Library version, source selection, crypto backend, build options, targets, and installation
@@ -356,4 +356,4 @@ HaiCrypt (`haicrypt/`):
 - `haicrypt.h`, `hcrypt.c`, `hcrypt_ctx_rx.c`, `hcrypt_ctx_tx.c`, `hcrypt_rx.c`, `hcrypt_tx.c` — Encryption API, key contexts, key rotation, and packet encrypt/decrypt paths
 - `hcrypt_sa.c`, `hcrypt_msg.h`, `hcrypt_xpt_srt.c` — Security associations, key messages, and SRT packet transport adapter
 - `cryspr.c`, `cryspr.h`, `cryspr-openssl*.c` — Crypto-provider abstraction and OpenSSL backends used by the SRS build
-- `cryspr-gnutls.*`, `cryspr-mbedtls.*` — Alternative crypto backends retained from upstream
+- `cryspr-gnutls.*`, `cryspr-mbedtls.*`, `cryspr-botan.*` — Alternative crypto backends retained from upstream

skills/srs-develop/SKILL.md

@@ -18,6 +18,12 @@ description: Develop, modify, debug, review, maintain, and explain the SRS and O
 
 For every standalone SRS runtime code change in either the Go proxy or C++ media server, run the complete bundled suite in `references/integration-tests.md` in addition to module-specific unit, black-box, protocol E2E, sanitizer, or benchmark verification. Apply this requirement during development, bug fixing, and pull-request review; do not treat the `proxy-*` script names as limiting the suite to proxy changes.
 
+## Version and Changelog
+
+Whenever a task bumps a version or adds a changelog entry, load `references/version-and-changelog.md` and follow it. Apply this in every workflow, not only Review a PR: bug fixes and feature work reach a version bump too, and the rules do not change with the routed task.
+
+For SRS this always means bumping **both** version files together — `trunk/src/core/srs_core_version8.hpp` and `internal/version/version.go`. Nothing in the build or tests catches a mismatch, so read both back after editing.
+
 ## Path Resolution
 
 - Use the current working directory as the project root. Do not search parent directories or discover alternate repository roots.

skills/srs-develop/references/develop-code.md

@@ -6,6 +6,8 @@
 
 **Important:** The C++ media server (origin + edge) is in **maintenance mode** — only bug fixes are accepted, no new features. New server features belong in the next-generation Go server. The SRS player and Dev Docker have separate supported workflows below. You may reference the C++ server's code to understand how things were done before, but do not add features to it.
 
+**Version and changelog:** If the change bumps a version or adds a changelog entry, load `references/version-and-changelog.md` and apply it, whichever service you routed to. For SRS that means bumping **both** version files, not only the C++ one.
+
 **Service Router** — Determine which service or product the change targets. Route to exactly ONE service. Do not guess — if unclear, ask the user to clarify.
 
 | Service | Route To | Status |

skills/srs-develop/references/fix-a-bug.md

@@ -64,7 +64,8 @@ Use this only when verification shows user misuse already covered by the selecte
 3. Implement the smallest fix and add regression coverage.
 4. Use `skills/internal-codemap-for-srs/SKILL.md` and `skills/internal-docs-for-srs/SKILL.md` to route the selected product and run the relevant verification. For Oryx, follow `references/oryx.md` and use only a disposable integration target.
 5. For any standalone SRS runtime fix in the Go proxy or C++ media server, run every command in `references/integration-tests.md` after focused and component-native tests. The suite is mandatory cross-component verification, not proxy-only coverage.
-6. If it is not a bug, update support or documentation only when needed; otherwise make no change.
+6. If the fix bumps a version or adds a changelog entry, load `references/version-and-changelog.md` and apply it. For SRS that means bumping **both** version files, not only the C++ one.
+7. If it is not a bug, update support or documentation only when needed; otherwise make no change.
 
 ## Step 4: Update the GitHub issue Truth Record
 

skills/srs-develop/references/review-a-pr.md

@@ -39,15 +39,4 @@
 ## Step 4: Apply project version and changelog rules
 
 1. Ask the user for the PR number if they haven't given it.
-2. For SRS, bump revision by one in **both** version files, keeping them in sync:
-   - `internal/version/version.go` — `VersionRevision()`
-   - `trunk/src/core/srs_core_version8.hpp` — `VERSION_REVISION`
-3. For SRS, add a new top entry to `trunk/doc/CHANGELOG.md` under `## SRS 8.0 Changelog`, matching the existing format:
-   ```
-   * v8.0, YYYY-MM-DD, Merge [#PR](URL): <Prefix>: <one-line summary>. v8.0.<rev> (#PR)
-   ```
-   Propose the summary to the user; don't invent one unilaterally.
-4. For Oryx, inspect `platform/version.go`, the newest entries under `DEVELOPER.md#changelog`, tags, and branch history before proposing a version. Do not assume the version constant and newest changelog entry are already synchronized.
-5. When the maintainer approves an Oryx version update, change `platform/version.go` and add the smallest matching entry under the current series in `DEVELOPER.md`. Do not change `releases/version.go`; its legacy `latest`, `api`, and `stable` values are a separate compatibility service unless the PR explicitly changes that service.
-6. Do not force a version bump for Oryx documentation, skill, issue-template, or maintenance-only work when the maintainer does not intend a release. Ask rather than infer.
-7. Stop and let the user review and stage the version and changelog files. After an explicit commit request, follow `SKILL.md`'s repository-aware Git Workflow.
+2. Load `references/version-and-changelog.md` and apply it. It is the single owner of the version-bump and changelog rules for both projects, including the requirement to keep the two SRS version files in sync.

skills/srs-develop/references/srs-issues.md

@@ -2,6 +2,22 @@
 
 Record only verified `ossrs/srs` maintenance status and the latest maintainer-approved Truth Record. Never copy unverified issue discussion. Keep Oryx records in `references/oryx-issues.md`.
 
+## #4727 [SECURITY] Bundled SRT 1.5.3 exposed CVE-2026-55868/55869 stack overflows
+
+- Issue: https://github.com/ossrs/srs/issues/4727
+- Truth Record: https://github.com/ossrs/srs/issues/4727#issuecomment-5356428807
+- Verified: 2026-08-20
+- Fix: PR https://github.com/ossrs/srs/pull/4729, SRS `8.0.29`, commit `5f00d0e1825b1512c670ff8c12d829841d145170`
+- Status: Fix pending merge; no v7 or v6 backport has been prepared or verified
+
+SRS vendored SRT 1.5.3 on all maintained branches. `processSrtMsg_KMREQ` and `processSrtMsg_KMRSP` copied `len/4` words into a 104-byte stack buffer with no capacity check. The enforced-encryption gate protects the handshake path, but not the post-connect `UMSG_EXT` path, which needs no passphrase — about 1352 bytes of stack overflow from any peer that completes a handshake. Exposure was limited to deployments that explicitly enable `srt_server`, which is off by default.
+
+Fixed by vendoring upstream 1.5.6. The three non-CVE fixes in 1.5.6 matter little for SRS: the LOSSREPORT and DROPREQ out-of-bounds reads stay inside the allocated packet slot, and the `dropMessage` guard is unreachable under SRS defaults.
+
+Useful for future upgrades: the fit tree is a pure subset of upstream with **zero** content modifications. The only SRS-local change is `trunk/3rdparty/patches/srt/api.cpp-01.patch`, applied at build time by `auto/depends.sh` and matched by content, so its line number drifts and should be regenerated each upgrade.
+
+Unknown: no PoC was built; reachability rests on static analysis.
+
 ## #4719 [BUG] External-SIP GB28181 sessions remain reserved after media termination
 
 - Issue: https://github.com/ossrs/srs/issues/4719

skills/srs-develop/references/version-and-changelog.md

@@ -0,0 +1,36 @@
+# Version and Changelog Rules
+
+**Scope:** The single owner of SRS and Oryx version-bump and changelog rules. Every workflow that bumps a version loads this file; do not restate these rules elsewhere.
+
+Apply these rules whenever a task bumps a version or adds a changelog entry, regardless of which task the router selected. A version bump is not exclusive to the Review a PR workflow — Fix a Bug and Develop Code reach it too.
+
+## SRS
+
+**Bump revision by one in both version files, and keep them in sync. Missing either one is a defect.**
+
+- `trunk/src/core/srs_core_version8.hpp` — `VERSION_REVISION`
+- `internal/version/version.go` — `VersionRevision()`
+
+The two files are separate products from the same release: the C++ media server and the Go proxy. Nothing in the build fails when they diverge, and no test catches it, so verify both by reading them after editing.
+
+Do not assume the two files already agree. History contains bumps that changed only the C++ file, so the Go proxy version may already lag before your change. Read both current values first; if they disagree, report the drift to the maintainer rather than silently bumping from different bases.
+
+Add a new top entry to `trunk/doc/CHANGELOG.md` under `## SRS 8.0 Changelog`, matching the existing format exactly:
+
+```
+* v8.0, YYYY-MM-DD, Merge [#PR](URL): <Prefix>: <one-line summary>. v8.0.<rev> (#PR)
+```
+
+Propose the summary to the user; don't invent one unilaterally.
+
+## Oryx
+
+Inspect `platform/version.go`, the newest entries under `DEVELOPER.md#changelog`, tags, and branch history before proposing a version. Do not assume the version constant and newest changelog entry are already synchronized.
+
+When the maintainer approves an Oryx version update, change `platform/version.go` and add the smallest matching entry under the current series in `DEVELOPER.md`. Do not change `releases/version.go`; its legacy `latest`, `api`, and `stable` values are a separate compatibility service unless the PR explicitly changes that service.
+
+## Both projects
+
+Do not force a version bump for documentation, skill, issue-template, or maintenance-only work when the maintainer does not intend a release. Ask rather than infer.
+
+Stop and let the user review and stage the version and changelog files. After an explicit commit request, follow `SKILL.md`'s repository-aware Git Workflow.

trunk/3rdparty/README.md

@@ -9,8 +9,8 @@ nginx-1.5.7.zip
 * for srs to support hls streaming.
 
 srt-1-fit
-srt-1.5.3.tar.gz
-* https://github.com/Haivision/srt/releases/tag/v1.5.3
+srt-1.5.6.tar.gz
+* https://github.com/Haivision/srt/releases/tag/v1.5.6
 * https://ossrs.net/lts/zh-cn/license#srt
 
 openssl-1.1-fit

trunk/3rdparty/patches/srt/api.cpp-01.patch

@@ -1,4 +1,4 @@
-1116c1116
+1312c1312
 <             LOGC(cnlog.Debug, log << "srt_accept: no pending connection available at the moment");
 ---
 >             LOGC(cnlog.Error, log << "srt_accept: no pending connection available at the moment");